---
title: "Poll and consume an approved agent request"
method: POST
path: "/auth/agent/token"
---

# Poll and consume an approved agent request

`POST /auth/agent/token`

## Request

- Base URL: `https://superskill.sh/api`
- URL: `https://superskill.sh/api/auth/agent/token`
- Auth: none declared

The local broker presents its device proof. Approval is consumed exactly once and returns a ten-minute opaque access token plus a rotating refresh token bounded by the thirty-day session.

## Request body

- AgentAuthorizationTokenRequest
  - `request_id` string, required
  - `device_proof` string, required

## Response `200`

Opaque agent credential pair

- AgentAuthorizationToken
  - `access_token` string, required
  - `refresh_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `session_expires_in` integer, required
  - `scope` string, required

## Other responses

- `202`: Explicit browser decision is still pending
- `400`: Bad request
- `403`: Authorization was provided but is not allowed for this action
- `410`: Authorization request expired
- `429`: Bounded polling rate exceeded
- `503`: Dependent service unavailable

---

[API](https://skmtc.dev/superskill/apis/superskill-api.md) · [All operations](https://skmtc.dev/superskill/apis/superskill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/superskill/apis/superskill-api/revisions/ced2d2d1f217?raw)