---
title: "Approve a pending client authorization"
method: POST
path: "/v2/account/authorize/approve"
tags: ["Authorization"]
---

# Approve a pending client authorization

`POST /v2/account/authorize/approve`

Approves a pending authorization created by `POST /v2/account/authorize/start` (browser flow, identified by `code`) or `POST /v2/account/authorize/device` (CLI flow, identified by the `user_code` the person typed).

Approval only **fills** a slot the client created and that nobody approved yet — it can never create one. That is what stops an attacker from overwriting someone else's pending authorization with their own account.

`display` is **required**: the person must type (or confirm) the 8-character code their editor/CLI is showing. Knowing the `code` alone is not enough to approve, which is what makes a forged consent link fail.

**Nothing is issued here.** The scopes stored at `start` are the ones granted (they are never re-read from the request), and the key itself is only minted when the client redeems the grant at `POST /v2/account/authorize/claim` — so the secret never sits in Redis waiting to be collected. After approval the grant lives for 60 seconds.

Before approving, the page must show the client name, the scopes, and the confirmation code.

Session token only.

## Request body

- object — Exactly one of `code` or `user_code`, plus `display`.
  - `code` string — Browser flow grant identifier.
  - `user_code` string — Device flow code typed by the person. Case-insensitive.
  - `display` string, required — The confirmation code the client is showing. Case-insensitive. In the device flow it is the same value as `user_code`.

## Response `200`

Authorization approved. The client has 60 seconds to redeem it.

- object
  - `status` 'success', required
  - `response` object, required
    - `client` object, required
      - `id` string, required
      - `name` string, required
    - `scopes` string[], required
    - `resources` unknown[], required
      - unknown
    - `display` string, required

## Other responses

- `400` — Malformed body (`INVALID_CODE`), `display` missing or different from the code the client is showing (`DISPLAY_MISMATCH`), already approved (`GRANT_ALREADY_APPROVED`), the client is no longer registered (`UNKNOWN_CLIENT`), or the grant asks for resources the account does not own (`RESOURCE_NOT_FOUND`).
- `401` — This endpoint requires a session token (JWT). API keys are not accepted.
- `404` — No pending authorization for that code — it expired, or it was already redeemed.
- `413` — The request body is larger than the maximum allowed size (100MB).
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)