---
title: "RFC 8628 device grant — when the user can reach a browser"
method: POST
path: "/api/auth/device/code"
tags: ["auth"]
---

# RFC 8628 device grant — when the user can reach a browser

`POST /api/auth/device/code`

## Request

- Base URL: `https://api.zettoai.com`
- URL: `https://api.zettoai.com/api/auth/device/code`
- Auth: none required

There is deliberately no verification_uri_complete and no QR code: a code embedded in a link is what makes cross-device consent phishing easy (RFC 10027 / BCP 247). Never send a user_code to anyone, and never ask someone to enter one you received from a third party.

## Request body

- object
  - `client_name` string

## Response `200`

Device and user codes

- object
  - `device_code` string
  - `user_code` string
  - `verification_uri` string, uri
  - `expires_in` integer
  - `interval` integer

---

[API](https://skmtc.dev/zettoai/apis/zetto-network-api.md) · [All operations](https://skmtc.dev/zettoai/apis/zetto-network-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zettoai/apis/zetto-network-api/revisions/a81077177fc2?raw)