# Exchange a device code for a token (/api/authentication/exchange-device-code)

`POST /api/auth/device/token`

Exchange device code for access token

Follow [rfc8628#section-3.4](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4)

Base URL: `https://runners.starsling.dev`

## Authentication

No credential required.

## Request body

Required, sent as `application/json`.

- `grant_type` — string, required. The grant type for device flow `urn:ietf:params:oauth:grant-type:device_code`
- `device_code` — string, required. The device verification code
- `client_id` — string, required. The client ID of the application

## Responses

| Status | Description |
| --- | --- |
| `200` | Success |
| `400` | Error response |
| `401` | Unauthorized. Due to missing or invalid authentication. |
| `403` | Forbidden. You do not have permission to access this resource or to perform this action. |
| `404` | Not Found. The requested resource was not found. |
| `429` | Too Many Requests. You have exceeded the rate limit. Try again later. |
| `500` | Internal Server Error. This is a problem with the server that you cannot fix. |

### `200` body

- `access_token` — string, required. The bearer token. Send it as `Authorization: Bearer <token>`.
- `token_type` — string, required. `Bearer`
- `expires_in` — number, required. Seconds until the token expires.
- `scope` — string. Space-separated granted scopes. Empty when none were requested.

### Example

```json
{
  "access_token": "sess_9f2c1b7a4d3e",
  "token_type": "Bearer",
  "expires_in": 604800,
  "scope": ""
}
```