---
title: "Start an RFC 8628 device authorization (headless login)"
method: POST
path: "/auth/device/code"
---

# Start an RFC 8628 device authorization (headless login)

`POST /auth/device/code`

## Request

- Base URL: `https://api.vakantio.de`
- URL: `https://api.vakantio.de/auth/device/code`
- Auth: none required

Begin an RFC 8628 device-authorization login for environments that cannot open a browser callback (containers, CI, sandboxes). Show the user_code and verification_uri to the user, then poll the token endpoint.

## Request body

- object
  - `client_name` string
  - `client_version` string

## Response `200`

Device + user codes per RFC 8628

- object
  - `device_code` string
  - `user_code` string
  - `verification_uri` string
  - `verification_uri_complete` string
  - `expires_in` integer
  - `interval` integer

## Other responses

- `4XX`: Client error — JSON body with a stable `error` code (e.g. not_found, not_authenticated, request_failed) and an optional `hint`.
- `5XX`: Server error — JSON body with `error: "server_error"`.

---

[API](https://skmtc.dev/vakantio/apis/vakantio-api.md) · [All operations](https://skmtc.dev/vakantio/apis/vakantio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vakantio/apis/vakantio-api/revisions/2e1306807326?raw)