Exchange a device code for a session
Polls a sign-in started with Start a device sign-in. It needs no credentials: deviceCode is the secret.
Call it every interval seconds (2). Until the sign-in completes it answers 400 with one of the error.code values listed below: keep polling on authorization_pending, and stop on the others.
After the person chooses Authorize, the next poll returns a new session (jvs_…) for that person and uses up the code, so later polls return invalid_grant. The session shows as client: "cli" in List your sessions. Send token as Authorization: Bearer jvs_… until expiresAt, 30 days later.
Polls are rate limited per client address and across all clients: a refused poll gets 429 rate_limited, and the client should wait Retry-After seconds. See Sign people in from your tool and Rate limits.
application/json- body
deviceCode*string10 <= length <= 200The person authorized the code; this is their new session.
application/json- response
A new API session from any sign-in method.
token*stringThe session's secret bearer token (jvs_…), returned only once; send it as Authorization: Bearer jvs_….
identity*stringThe sign-in identity of the person the session belongs to.
expiresAt*stringWhen the session ends unless it is revoked first (ISO 8601, UTC).
curl -X POST 'https://api.cubicle.sh/v1/auth/device/token' \ -H 'Content-Type: application/json' \ -d '{ "deviceCode": "jvd_qRbPpKtAPzyMvWuZ4Pp_3fQxlO0lB7qDcE9E2MpjzJM"}'{ "token": "jvs_lhxa_0pvIYcKCzNEyglwfzH8TbnsmXmRVcCTJ1xaQr8", "identity": "ada@example.com", "expiresAt": "2026-12-05T10:16:40.000Z"}