> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Poll for the device sign-in token

> Exchanges an approved device code for a CLI session token, which is
then sent as `Authorization: Bearer <access_token>` (the `cliSession`
scheme). Until the user approves, the response is 400 with `error`
set to `authorization_pending`; polling faster than `interval` gives
`slow_down`. Other `error` values are `expired_token`, `access_denied`,
`invalid_grant` (unknown or already used code), `invalid_request` and
`unsupported_grant_type`. Each code yields one token. Accepts JSON or
`application/x-www-form-urlencoded`.




## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/auth/device/token
openapi: 3.1.0
info:
  title: Qumo Deploy REST API
  description: >
    The Qumo Deploy control plane: organizations, projects, signing keys,
    machine

    identities, access control, audit and billing. Relay credentials are not

    issued here: your app signs them with its own

    [signing keys](/guides/signing-keys).


    Every operation here is generated against the routes the server registers

    and checked in CI, so an operation in this reference exists and a route

    missing from it is deliberately internal (relay mesh, webhooks, probes,

    operator-only and browser sign-in routes).


    Errors are JSON objects with one `error` field. What each status code means

    is in [Error codes](/guides/error-codes); the token scope each permission

    needs is in [Scopes and permissions](/guides/scopes-permissions).
  version: 1.0.0
servers:
  - url: https://api.qumo-deploy.com
    description: Public API (Bearer tokens only; cookies are ignored)
security: []
tags:
  - name: Account
    description: The signed-in user's own sessions, tokens, security settings and data.
  - name: Device flow
    description: OAuth 2.0 device authorization, used by `qumod login`.
  - name: Organizations
    description: Organizations, their members and usage.
  - name: Projects
    description: Projects inside an organization.
  - name: Signing keys
    description: Keys your app signs relay credentials with.
  - name: Relays
    description: Where clients of a broadcast path connect.
  - name: Identities
    description: Machine identities, their tokens and IP allowlists.
  - name: Access control
    description: Roles, IAM bindings and invitations.
  - name: Audit
    description: The audit log and its webhook.
  - name: Notifications
    description: Notification policies.
  - name: Billing
    description: Plans, usage cost, budgets, invoices and payment methods.
  - name: Pricing
    description: Public price list.
paths:
  /v1/auth/device/token:
    post:
      tags:
        - Device flow
      summary: Poll for the device sign-in token
      description: |
        Exchanges an approved device code for a CLI session token, which is
        then sent as `Authorization: Bearer <access_token>` (the `cliSession`
        scheme). Until the user approves, the response is 400 with `error`
        set to `authorization_pending`; polling faster than `interval` gives
        `slow_down`. Other `error` values are `expired_token`, `access_denied`,
        `invalid_grant` (unknown or already used code), `invalid_request` and
        `unsupported_grant_type`. Each code yields one token. Accepts JSON or
        `application/x-www-form-urlencoded`.
      operationId: pollDeviceToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceTokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeviceTokenRequest'
      responses:
        '200':
          description: The user approved; here is the session token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceToken'
        '400':
          $ref: '#/components/responses/BadRequest'
      security: []
components:
  schemas:
    DeviceTokenRequest:
      type: object
      required:
        - grant_type
        - device_code
      properties:
        grant_type:
          type: string
          enum:
            - urn:ietf:params:oauth:grant-type:device_code
          example: urn:ietf:params:oauth:grant-type:device_code
        device_code:
          type: string
          example: Xq7vR2mK9pL4tN8wZ3cY6bH1jF5sD0aG2eU7iO4kM9n
    DeviceToken:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
          description: >-
            The CLI session token. Send it as `Authorization: Bearer
            <access_token>`.
          example: >-
            k3Rz8vQ1mN5pX7wL2cT9bY4hJ6sF0aD3gU8eI1oK5nM7rV2qZ9xW4tC6yB1jH8fS3dA0gE5uP7iL2kN9mR4vQ6zXw
        token_type:
          type: string
          enum:
            - bearer
          example: bearer
        expires_in:
          type: integer
          description: Seconds until the session expires (7 days).
          example: 604800
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: A human-readable message.
          example: organization_id is required
  responses:
    BadRequest:
      description: >-
        Malformed request or failed validation. See [Error
        codes](/guides/error-codes).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.