# Start the device flow (/api/authentication/request-device-code)

`POST /api/auth/device/code`

Request a device and user code

Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#section-3.2)

Base URL: `https://runners.starsling.dev`

## Authentication

No credential required.

## Request body

Required, sent as `application/json`.

- `client_id` — string, required. The client ID of the application
- `user_id` — string. The user ID to which the device code should be pre-bound.
- `scope` — string. Space-separated list of scopes

## Responses

| Status | Description |
| --- | --- |
| `200` | Success |
| `400` | Error response |
| `401` | Unauthorized. Due to missing or invalid authentication. |
| `403` | Forbidden. You do not have permission to access this resource or to perform this action. |
| `404` | Not Found. The requested resource was not found. |
| `429` | Too Many Requests. You have exceeded the rate limit. Try again later. |
| `500` | Internal Server Error. This is a problem with the server that you cannot fix. |

### `200` body

- `device_code` — string. The device verification code
- `user_code` — string. The user code to display
- `verification_uri` — string. The URL for user verification. Defaults to /device if not configured.
- `verification_uri_complete` — string. The complete URL with user code as query parameter.
- `expires_in` — number. Lifetime in seconds of the device code
- `interval` — number. Minimum polling interval in seconds

### Example

```json
{
  "device_code": "5f1c9d0e8b3a4c27",
  "user_code": "8226-T2GH",
  "verification_uri": "https://runners.starsling.dev/cli-login",
  "verification_uri_complete": "https://runners.starsling.dev/cli-login?user_code=8226-T2GH",
  "expires_in": 1800,
  "interval": 5
}
```