auth

RFC 8628 device grant — when the user can reach a browser

There is deliberately no verification_uri_complete and no QR code: a code embedded in a link is what makes cross-device consent phishing easy (RFC 10027 / BCP 247). Never send a user_code to anyone, and never ask someone to enter one you received from a third party.

post/api/auth/device/code

Request

Base URL: https://api.zettoai.com
URL: https://api.zettoai.com/api/auth/device/code
Auth: none required

Request body

client_namestring

Response

Device and user codes

device_codestring

user_codestring

verification_uristring uri

expires_ininteger

intervalinteger

Example response

{
  "user_code": "K4M2-P8QR"
}

Changes

No recorded changes to this operation across all 1 revision of this API.