---
title: "Decide CLI device login"
method: POST
path: "/v2/cli.decideDeviceLogin"
tags: ["cli"]
---

# Decide CLI device login

`POST /v2/cli.decideDeviceLogin`

## Request

- Base URL: `https://api.unkey.com`
- URL: `https://api.unkey.com/v2/cli.decideDeviceLogin`
- Auth: HTTP bearer

Approves or denies a device login using the signed-in dashboard user's session.
Approval requires permissions. Denial must not include permissions and prevents token issuance.
Every permission must fit inside the caller's role. Any member can approve, not only admins.
The CLI session is created later, when the CLI polls, with this set or a narrower one if the member's role changed.

## Request body

- union
  - object
    - `userCode` string, required: Code shown in the terminal.
    - `decision` 'approve', required
    - `permissions` string[], required: Permissions to grant. Each permission must be within the caller's role.
  - object
    - `userCode` string, required: Code shown in the terminal.
    - `decision` 'deny', required
    - `permissions` string[]: Permissions to grant. Each permission must be within the caller's role.

## Response `200`

Decision recorded.

- V2CliDecideDeviceLoginResponseBody
  - `meta` Meta, required: Metadata object included in every API response. This provides context about the request and is essential for debugging, audit trails, and support inquiries. The `requestId` is particularly important when troubleshooting issues with the Unkey support team.
    - `requestId` string, required: A unique id for this request. Always include this ID when contacting support about a specific API request. This identifier allows Unkey's support team to trace the exact request through logs and diagnostic systems to provide faster assistance.
  - `data` EmptyResponse, required: Empty response object by design. A successful response indicates this operation was successfully executed.

## Other responses

- `400`: Invalid decision, code, or permission, or the login is closed.
- `401`: Unauthorized
- `403`: The caller cannot grant these permissions or another account approved this login.
- `500`: Internal server error.

## Changes

- **2026-10-28** `5949ec68734a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/unkeyed/apis/unkey-api/changes/v2/cli.decideDeviceLogin/post.md)

---

[API](https://skmtc.dev/unkeyed/apis/unkey-api.md) - [All operations](https://skmtc.dev/unkeyed/apis/unkey-api/llms.txt) - [OpenAPI document](https://skmtc.dev/unkeyed/apis/unkey-api/revisions/6fbaa27f19e0?raw)