# Approve a device authorization

Approves the device behind `userCode` for the chosen scopes and team access. `scopes` must be a subset of what the device requested, and every team named in `teams` must be one the signed-in user belongs to. The device receives its one-time API key on its next poll; a Space attached to the flow is claimed into `claimTeamId` and returned as `claimedSpaceId`. Requires a signed-in browser session.

## POST `/v1/auth/device/approve`

### Authorization

`__Host-better-auth.session_token` API key · cookie required

Dashboard session cookie set at sign-in. An operation that lists only this scheme needs a person: API keys and machine credentials are refused. The same session token also works as \`Authorization: Bearer\`.

### Request body

required `application/json`

- `agentContinuation` boolean

Leaves the Space key exchangeable once for a Space-scoped API key, so the agent that published stays authorized after the claim. Ignored unless the flow carries a claim, and defaults to false.

- `claimTeamId` string

Team that receives the claimed Space. Required when the flow carries a claim, and must be one of the teams named in \`teams\`.

min length 1

- `scopes` string\[\] required

Scopes to grant. Must be a subset of what the device requested. What each scope reaches is capped per team by the holder's live role at the time of each request.

min items 1

- `teams` object required

Teams to grant: \`all\` follows every team the approver belongs to, including teams joined later, \`teams\` grants only the listed ones, \`none\` grants sign-in alone. Every listed team must be one the approver belongs to.

Show properties Hide properties

One of:

- object

- `teamIds` string\[\] required

Teams the credential may act in. Each team appears once.

min items 1 · max items 100

- object

- `userCode` string required

User code shown on the device being approved. Dashes and letter case are ignored.

min length 1 · max length 32

### Responses

#### 200 Response for status 200

- `$schema` string<uri>

Canonical JSON Schema URL for this response body. The server also sends it in the \`Link: rel="describedby"\` response header.

- `data` object required

Show properties Hide properties

- `status` string required

Always \`approved\`; the call fails instead of returning any other value.

- `claimedSpaceId` string | any required

Space claimed by this approval. Null when the flow carried no claim.

Show properties Hide properties

Any of:

- string

- any

defaultError. Every 4xx and 5xx response is one RFC 9457 problem document served as \`application/problem+json\`.

- `$schema` string<uri>

Canonical JSON Schema URL for this response body. The server also sends it in the \`Link: rel="describedby"\` response header.

- `type` string required

URL of the documentation page for this error. Derived from \`code\`.

- `title` string required

Human-readable name of the error type. Derived from \`code\`.

- `status` integer required

HTTP status of the response, repeated in the body.

min -9007199254740991 · max 9007199254740991

- `detail` string required

What went wrong in this request.

- `code` string required

Stable snake_case error code. Match on this, not on \`detail\`.

- `pointer` string

RFC 6901 JSON Pointer to the request field or batch entry that failed, for example \`/files/37/path\`. Present on validation failures.

- `details` object

Machine-readable context keyed by the error code.

- `suggestions` string\[\]

Recovery steps safe to show to a person.

- `next` string\[\]

Commands or API requests to run next, usable as written.

- `requestId` string required

ID of this request, from the \`X-Request-Id\` header or generated. Quote it when contacting support.

### Try it

#### Server

- Base URL https://api.spacefast.com
- Custom base URL Overrides the selected server when set.

### Authorization

- API key Remember on this device Include my values in samples

### Body: application/json

#### Request body

```json
{
  "agentContinuation": true,
  "claimTeamId": "string",
  "scopes": [
    "teams:read"
  ],
  "teams": {},
  "userCode": "string"
}
```

```javascript
const response = await fetch("https://api.spacefast.com/v1/auth/device/approve", {
  method: "POST",
  headers: {
    "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: "{\n  \"agentContinuation\": true,\n  \"claimTeamId\": \"string\",\n  \"scopes\": [\n    \"teams:read\"\n  ],\n  \"teams\": {},\n  \"userCode\": \"string\"\n}"
});
```

```python
import requests

response = requests.post(
    "https://api.spacefast.com/v1/auth/device/approve",
    headers={
        "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    data="{\n  \"agentContinuation\": true,\n  \"claimTeamId\": \"string\",\n  \"scopes\": [\n    \"teams:read\"\n  ],\n  \"teams\": {},\n  \"userCode\": \"string\"\n}",
)
```

### Response

#### 200 default

```json
{
  "$schema": "http://example.com",
  "data": {
    "status": "approved",
    "claimedSpaceId": "string"
  }
}
```

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": ["string"],
  "next": ["string"],
  "requestId": "string"
}
```