Start OAuth device authorization.

POST /oauth/device/code

Scope-less requests for the canonical /mcp resource defer permission selection to the signed-in device consent page; other omitted-scope requests stay read-only.

Access

This operation does not declare a credential requirement in the released API contract.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. Set up developer access.

Request body

Required. Supported content types: application/json, application/x-www-form-urlencoded.

Field	Type	Required
`client_id`	string	Yes
`scope`	string	No
`target`	TokenTarget	No
`resource`	string	No
`client_name`	string	No

Call the endpoint

Replace path placeholders and your credential. For body operations, create request.json using the required fields above; this command does not invent resource identifiers or consent.

curl --request POST \
  'https://commentary.dev/oauth/device/code' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json

Responses

Status	Meaning	Payload
`200`	Successful response.	object
`400`	OAuth request error.	OAuthError
`429`	The request was rate limited.	OAuthError

Successful response fields

Field	Type	Required	Description
`device_code`	string	No
`user_code`	string	No
`verification_uri`	string	No	Format: uri.
`verification_uri_complete`	string	No	Format: uri.
`expires_in`	integer	No
`interval`	integer	No

Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

Operation ID: createOAuthDeviceCode. Download the OpenAPI contract for complete constraints and code generation. Browse endpoints.