Start a device sign-in
Starts the OAuth 2.0 device authorization flow (RFC 8628) that cubicle login uses, for clients that cannot receive a browser redirect: nothing calls back into the client, which only polls. It needs no credentials and no body, and each call starts a separate sign-in with new codes.
- Call this route. It returns a secret
deviceCodefor the client and a shortuserCode(XXXX-XXXX) for the person. - Send the person to
verificationUriComplete, the Dashboard's/devicepage with the code filled in, and showuserCodeso they can check that it matches. They sign in if needed and choose Authorize or Deny. - Meanwhile, call Exchange a device code for a session with
deviceCodeeveryintervalseconds (2), until it returns a session or fails, for at mostexpiresInseconds (600).
The session belongs to the person who chose Authorize, whoever started the flow. Calls are rate limited per client address and across all clients before anything else runs; see Rate limits. Sign people in from your tool walks through the flow.
The sign-in has started.
application/json- response
deviceCode*stringThe secret code the client polls with (jvd_…). Keep it secret: whoever holds it receives the session.
userCode*stringThe code the person checks in the Dashboard: 8 consonants as XXXX-XXXX.
^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$expiresIn*integerSeconds until the codes expire: 600.
interval*integerSeconds to wait between polls: 2.
verificationUri*stringThe Dashboard's device page, without the code.
uriverificationUriComplete*stringThe Dashboard's device page with userCode filled in. Send the person here.
uricurl -X POST 'https://api.cubicle.sh/v1/auth/device'{ "deviceCode": "jvd_qRbPpKtAPzyMvWuZ4Pp_3fQxlO0lB7qDcE9E2MpjzJM", "userCode": "BCDF-GHJK", "expiresIn": 600, "interval": 2, "verificationUri": "https://app.cubicle.sh/device", "verificationUriComplete": "https://app.cubicle.sh/device?user_code=BCDF-GHJK"}