---
title: "Start a browser login for the CLI"
method: POST
path: "/api/auth/device/code"
tags: ["Authentication"]
---

# Start a browser login for the CLI

`POST /api/auth/device/code`

## Request

- Base URL: `https://demo.supercheck.dev`
- URL: `https://demo.supercheck.dev/api/auth/device/code`
- Auth: none required

RFC 8628 device authorization request. Public; returns a short user code to confirm in the browser. No credential is returned. Available only when the server enables browser login (`DEVICE_AUTH_ENABLED=true`); otherwise returns 503 `device_auth_disabled`.

## Request body `application/x-www-form-urlencoded`

- object
  - `client_id` 'supercheck-cli', required
  - `client_name` string
  - `cli_version` string
  - `hostname` string

## Response `200`

Device authorization started.

- object
  - `device_code` string, required: Secret polled by the CLI. Never display or log it.
  - `user_code` string, required
  - `verification_uri` string, uri, required
  - `verification_uri_complete` string, uri
  - `expires_in` integer, required
  - `interval` integer, required

## Other responses

- `400`: Malformed request body.
- `401`: Unknown client id.
- `429`: Too many requests.
- `500`: Server error.
- `503`: Browser login is disabled on this server.

## Changes

- **2026-10-20** `74087800edc9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supercheck-io/apis/supercheck-api/changes/api/auth/device/code/post.md)

---

[API](https://skmtc.dev/supercheck-io/apis/supercheck-api.md) - [All operations](https://skmtc.dev/supercheck-io/apis/supercheck-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supercheck-io/apis/supercheck-api/revisions/7fa0162c07bd?raw)