---
title: "Start a device client authorization"
method: POST
path: "/v2/account/authorize/device"
tags: ["Authorization"]
---

# Start a device client authorization

`POST /v2/account/authorize/device`

Starts the CLI flow, for clients that cannot receive a browser redirect. Public: the client has no credential yet.

Returns a `device_code` (which the client keeps and polls `POST /v2/account/authorize/claim` with) and a `user_code` the person types on the consent page. Poll no faster than `interval` seconds or the per-IP limit trips. Both expire in 10 minutes.

The consent page must state that the person should only type a code **they just generated themselves** — a code sent to them by someone else is the standard phishing shape of this flow (RFC 8628 §5.3).

As in the browser flow, the client sends only the SHA-256 of its PKCE verifier; the verifier itself never leaves the machine and is what proves ownership at redemption.

## Request body

- object
  - `client_id` 'cli', required
  - `scopes` string[], required
  - `resources` string[] — Optional. Restricts the resulting key to these applications/databases.
  - `challenge` string, required — base64url(SHA-256(verifier)).
  - `challenge_method` 'S256' — Optional; S256 is the only value.

## Response `200`

Device authorization started. Show `user_code` and `verification_uri` to the person.

- object
  - `status` 'success', required
  - `response` object, required
    - `device_code` string, required
    - `user_code` string, required
    - `verification_uri` string, uri, required
    - `expires_in` integer, required
    - `interval` integer, required

## Other responses

- `400` — `UNKNOWN_CLIENT`, `INVALID_SCOPES`, `INVALID_RESOURCES`, `INVALID_CHALLENGE`, `INVALID_JSON_BODY` or `UNKNOWN_IP`.
- `413` — Body over 4 KB.
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)