Approve a device authorization

Approves the device behind userCode for the chosen scopes and team access. scopes must be a subset of what the device requested, and every team named in teams must be one the signed-in user belongs to. The device receives its one-time API key on its next poll; a Space attached to the flow is claimed into claimTeamId and returned as claimedSpaceId. Requires a signed-in browser session.

POST /v1/auth/device/approve

Authorization

__Host-better-auth.session_token API key · cookie required

Dashboard session cookie set at sign-in. An operation that lists only this scheme needs a person: API keys and machine credentials are refused. The same session token also works as `Authorization: Bearer`.

Request body

required application/json

• agentContinuation boolean

Leaves the Space key exchangeable once for a Space-scoped API key, so the agent that published stays authorized after the claim. Ignored unless the flow carries a claim, and defaults to false.

• claimTeamId string

Team that receives the claimed Space. Required when the flow carries a claim, and must be one of the teams named in `teams`.

min length 1

• scopes string[] required

Scopes to grant. Must be a subset of what the device requested. What each scope reaches is capped per team by the holder's live role at the time of each request.

min items 1

• teams object required

Teams to grant: `all` follows every team the approver belongs to, including teams joined later, `teams` grants only the listed ones, `none` grants sign-in alone. Every listed team must be one the approver belongs to.

Show properties Hide properties

One of:

• object

• teamIds string[] required

Teams the credential may act in. Each team appears once.

min items 1 · max items 100

• object

• userCode string required

User code shown on the device being approved. Dashes and letter case are ignored.

min length 1 · max length 32

Responses

200 Response for status 200

• $schema string

Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

• data object required

Show properties Hide properties

• status string required

Always `approved`; the call fails instead of returning any other value.

• claimedSpaceId string | any required

Space claimed by this approval. Null when the flow carried no claim.

Show properties Hide properties

Any of:

• string

• any

defaultError. Every 4xx and 5xx response is one RFC 9457 problem document served as `application/problem+json`.

• $schema string

Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

• type string required

URL of the documentation page for this error. Derived from `code`.

• title string required

Human-readable name of the error type. Derived from `code`.

• status integer required

HTTP status of the response, repeated in the body.

min -9007199254740991 · max 9007199254740991

• detail string required

What went wrong in this request.

• code string required

Stable snake_case error code. Match on this, not on `detail`.

• pointer string

RFC 6901 JSON Pointer to the request field or batch entry that failed, for example `/files/37/path`. Present on validation failures.

• details object

Machine-readable context keyed by the error code.

• suggestions string[]

Recovery steps safe to show to a person.

• next string[]

Commands or API requests to run next, usable as written.

• requestId string required

ID of this request, from the `X-Request-Id` header or generated. Quote it when contacting support.

Try it

Server

• Base URL https://api.spacefast.com
• Custom base URL Overrides the selected server when set.

Authorization

• API key Remember on this device Include my values in samples

Body: application/json

Request body

{
  "agentContinuation": true,
  "claimTeamId": "string",
  "scopes": [
    "teams:read"
  ],
  "teams": {},
  "userCode": "string"
}

const response = await fetch("https://api.spacefast.com/v1/auth/device/approve", {
  method: "POST",
  headers: {
    "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: "{\n  \"agentContinuation\": true,\n  \"claimTeamId\": \"string\",\n  \"scopes\": [\n    \"teams:read\"\n  ],\n  \"teams\": {},\n  \"userCode\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://api.spacefast.com/v1/auth/device/approve",
    headers={
        "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    data="{\n  \"agentContinuation\": true,\n  \"claimTeamId\": \"string\",\n  \"scopes\": [\n    \"teams:read\"\n  ],\n  \"teams\": {},\n  \"userCode\": \"string\"\n}",
)

Response

200 default

{
  "$schema": "http://example.com",
  "data": {
    "status": "approved",
    "claimedSpaceId": "string"
  }
}

{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": ["string"],
  "next": ["string"],
  "requestId": "string"
}