Accounts & authentication

Approve or deny a terminal's login

POST /api/v1/auth/device/code

Approves or denies a terminal login. For the web app's device page, from a browser that a person signed in to with an email link, a passkey, or a provider, within the last 10 minutes; a token cannot, so it cannot mint another that outlives it. An older session answers 403 with next.action sign_in: sign in again, then send the code again; the web app keeps it through that sign-in. Without approve, looks up the login waiting for the code a terminal shows; with it, answers. client_name is what the terminal calls itself, its own words; requested_from and requested_at say where and when it asked.

Parameters

Originheader · required · string

This server's origin. Required with the browser session cookie.

Idempotency-Keyheader · optional · string

Makes a retry safe: a request with the same key and the same method, path, and body as an earlier one gets the earlier response instead of doing the work again. 1 to 255 visible ASCII characters; use a new key for each new request, such as a UUID. Keys are kept per caller for a day, and ignored for requests without credentials.

Minimum length: 1 · Maximum length: 255

Example request

curl --request POST 'https://commitscale.com/api/v1/auth/device/code' \
  --cookie "__Host-cs_session=$CSCALE_SESSION" \
  --header 'Origin: https://commitscale.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "user_code": "BCDF-GHJK"
}'

Example values illustrate the format. Use your own credentials and identifiers.

Request body

application/json

A code that cscale auth login shows, typed on the device page.

approveoptional · boolean: Approve or deny; absent to only look the login up.
user_coderequired · string: Short code shown in the terminal for the person to approve on the device page.

Responses

200 The login, and its status now.

application/json

{
  "client_name": "cscale",
  "expires_at": "2026-10-26T10:00:00Z",
  "requested_at": "2026-10-26T10:00:00Z",
  "status": "pending",
  "user_code": "BCDF-GHJK"
}

A terminal's login, as the device page shows it.

client_nameoptional · string: The application name shown to the person approving the sign-in.
expires_atrequired · string (date-time): When this credential or request expires, in UTC.
requested_atrequired · string (date-time): When the terminal asked.
requested_fromoptional · string: The IP address the terminal asked from, as the server saw it, so a person can tell their own terminal's request.
statusrequired · pending / approved / denied: Where the login stands.
user_coderequired · string: Short code shown in the terminal for the person to approve on the device page.

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

check_key_scope403

A check-only key may call the test check, read its own usage and acceptance rule, contact support, and withdraw data sharing.

Use a person's sign-in for account management. More agent power needs the owner's passkey; this key cannot widen itself.

feature_off403

The namespace plan does not include this feature.

Retrying on the same plan will not help. GET /api/v1/namespaces/{namespace}/plan, and the namespace's Plan page in Settings, show what its plan includes.

unauthenticated401

The request carried no credentials.

Use this operation's sign-in method. Bearer credentials use Authorization: Bearer <token>; browser credentials use the session cookie.

invalid_token401

The token is unknown, expired, or revoked, its agent was revoked, or an OAuth token was used outside its MCP resource.

Stop using it. Sign in again, or ask the owner to create a replacement agent key.

forbidden403

The caller may not do this: only people may, only owners may, or the agent was not given this repository or write access.

Stop. Retrying will not help. Ask the owner for the access, or leave the step to a person.

not_found404

It does not exist, or the caller cannot read it: a repository the caller cannot read is reported as not found.

Check the name or ID, and that the token has the repository.

invalid_request400 / 413 / 415 / 422

The request is malformed or breaks a rule, such as a title that is too long, or a body that is not the expected JSON.

Fix the request as detail says. The same request fails the same way.

quota_exceeded422 / 429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.

idempotency_key_reused409 / 422

The idempotency key was already used for a different request.

Use a new key for each new request, and the same key only for a retry of the same request.

idempotency_key_in_use409

The first request with this key is still running, including a queued model question, or it succeeded with a secret, such as a new token, which is never replayed.

When Retry-After is set, retry then with the same key. Otherwise the first request succeeded: do not repeat it.

expired_token400

A device login code, sign-up, sign-in link, or passkey prompt expired or was already used.

Start a new flow. If a sign-up already created the account but its key was lost, the person signs in to revoke and replace that key.

access_denied400

A device login was denied or refused after five wrong codes, or the passkey does not sign in here.

Stop. After five wrong codes, start a new login; otherwise, sign in another way.

internal500

The server failed, and logged why.

Retry after Retry-After seconds. A write is safe to retry with the same idempotency key.

unavailable503

With 502, a service the server needs did not answer, such as a sign-in provider. With 503, the server is busy, such as when a workspace is locked or host lookups are full, or a write with an idempotency key runs long: that write goes on, and its answer is kept for the key.

With 502, retry later, or sign in another way. With 503, retry after Retry-After seconds, using the same idempotency key for a write; a long-running write can then replay its answer.