---
title: "Start the RFC 8628 device-code flow. No auth."
method: POST
path: "/api-keys/device-code"
tags: ["API keys"]
---

# Start the RFC 8628 device-code flow. No auth.

`POST /api-keys/device-code`

## Request

- Base URL: `https://api.stacktr.ee`
- URL: `https://api.stacktr.ee/api-keys/device-code`
- Auth: none required

Returns { device_code, user_code, verification_url, verification_url_complete, interval, expires_in }. Print verification_url_complete for the human, then poll. Codes live 10 minutes. Rate limited per IP.

## Request body

- object
  - `client_hint` string: Names the agent in the human’s approval screen and in the key label.

## Response `201`

Codes issued.

- object
  - `device_code` string, required: Secret. Send this on every poll; never show it to the human.
  - `user_code` string, required: Short code the human confirms on screen, e.g. "K3PQ-7RTM".
  - `verification_url` string, uri, required
  - `verification_url_complete` string, uri: The URL to print: it carries the user_code already.
  - `interval` integer, required: Seconds to wait between polls.
  - `expires_in` integer, required: Seconds until the code dies.

## Other responses

- `429`: Per-IP rate limit.

---

[API](https://skmtc.dev/stacktr/apis/stacktree-api.md) · [All operations](https://skmtc.dev/stacktr/apis/stacktree-api/llms.txt) · [OpenAPI document](https://skmtc.dev/stacktr/apis/stacktree-api/revisions/5878cce46977?raw)