---
title: "Resolve a pending client authorization for the consent screen"
method: GET
path: "/v2/account/authorize/pending/{userCode}"
tags: ["Authorization"]
---

# Resolve a pending client authorization for the consent screen

`GET /v2/account/authorize/pending/{userCode}`

Resolves a pending authorization so the consent screen can render **what the server actually stored**: the client, the scopes and the resource restriction.

Accepts both the 8-character code a person types (CLI device flow, case-insensitive) and the 32-character `code` the browser flow carries in the URL. Never render the scope list from URL parameters — a forged link would then show one thing and grant another.

**The confirmation code is deliberately NOT returned.** The screen must ask the person to type the 8 characters their editor or CLI is showing, and send them as `display` to `POST /v2/account/authorize/approve`, which compares them server-side. Handing that value back here would mean anyone who learned the `code` could approve, and approval decides **which account** the client ends up connected to. In the device flow the person already typed it to reach this screen, so it can be echoed straight through.

`approved: true` means the request was already approved and the person should return to the client.

Session token only. Rate limited to keep the 8-character space non-enumerable.

## Path parameters

- `userCode` string, required

## Response `200`

Pending authorization details.

- object
  - `status` 'success', required
  - `response` object, required
    - `client` object, required
      - `id` string, required
      - `name` string, required
    - `scopes` string[], required
    - `resources` unknown[], required
      - unknown
    - `device` boolean, required
    - `approved` boolean, required

## Other responses

- `401` — This endpoint requires a session token (JWT). API keys are not accepted.
- `404` — No pending authorization for that code — it expired, or it was already redeemed.
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)