---
title: "Exchange an approved device code for a CLI key"
method: POST
path: "/api/auth/device/token"
tags: ["Authentication"]
---

# Exchange an approved device code for a CLI key

`POST /api/auth/device/token`

## Request

- Base URL: `https://demo.supercheck.dev`
- URL: `https://demo.supercheck.dev/api/auth/device/token`
- Auth: none required

RFC 8628 device access token request. Poll no faster than the returned `interval`. On success a project-scoped CLI key (90-day expiry) is created and returned exactly once; a lost response cannot be recovered, revoke the unused key under CLI tokens and log in again.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'urn:ietf:params:oauth:grant-type:device_code', required
  - `client_id` 'supercheck-cli', required
  - `device_code` string, required

## Response `200`

Approved. Response is not cacheable (`Cache-Control: no-store`).

- object
  - `access_token` string, required: Project-scoped CLI key (`sck_live_*`).
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `context` object: Non-secret user, organization and project the key belongs to.

## Other responses

- `400`: OAuth 2.0 device-authorization error (RFC 8628 §3.5)
- `401`: OAuth 2.0 device-authorization error (RFC 8628 §3.5)
- `409`: OAuth 2.0 device-authorization error (RFC 8628 §3.5)
- `429`: Polling too fast or rate limited.
- `500`: Server error.
- `503`: Browser login is disabled on this server.

## Changes

- **2026-10-20** `74087800edc9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supercheck-io/apis/supercheck-api/changes/api/auth/device/token/post.md)

---

[API](https://skmtc.dev/supercheck-io/apis/supercheck-api.md) - [All operations](https://skmtc.dev/supercheck-io/apis/supercheck-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supercheck-io/apis/supercheck-api/revisions/7fa0162c07bd?raw)