---
title: "Start browser authorization for a local SuperSkill agent"
method: POST
path: "/auth/agent/start"
---

# Start browser authorization for a local SuperSkill agent

`POST /auth/agent/start`

## Request

- Base URL: `https://superskill.sh/api`
- URL: `https://superskill.sh/api/auth/agent/start`
- Auth: none declared

Creates a durable ten-minute request. The device proof is returned only in JSON; the independent browser proof appears only in the URL fragment after # in browser_url and therefore never reaches HTTP logs.

## Request body

- AgentAuthorizationStartRequest
  - `client` 'codex' | 'claude-code' | 'cli', required
  - `scopes` string[], required

## Response `201`

Bounded authorization request

- AgentAuthorizationStart
  - `request_id` string, required
  - `device_proof` string, required
  - `browser_url` string, uri, required: The browser proof is present only in the URL fragment.
  - `verification_uri` string, uri, required
  - `expires_in` integer, required
  - `interval` integer, required

## Other responses

- `400`: Bad request
- `429`: Bounded per-client start rate exceeded
- `503`: Dependent service unavailable

---

[API](https://skmtc.dev/superskill/apis/superskill-api.md) · [All operations](https://skmtc.dev/superskill/apis/superskill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/superskill/apis/superskill-api/revisions/ced2d2d1f217?raw)