Start a device-grant login (RFC 8628 style)

POST 
/auth/device

UNAUTHENTICATED. Show the returned user_code and verification_uri to the user; they approve in a logged-in browser. Then poll POST /auth/device/token every interval seconds. Codes expire after expires_in seconds (15 min). Per-IP rate limited.

Request

Responses

200

Device code allocated

429

Rate limit exceeded (rate_limit_exceeded, or plan budgets post_limit_reached / daily_limit_reached on schedulePost). All 429s carry Retry-After. The API-key limiter additionally sets the X-RateLimit-* headers and error.details {limit, remaining, reset_at}.

Response Headers

Retry-After

Seconds to wait before retrying

X-RateLimit-Limit

Requests allowed in the window (API-key limiter only)

X-RateLimit-Remaining

Requests remaining (API-key limiter only)

X-RateLimit-Reset

Unix seconds when the window resets (API-key limiter only)

500

Internal error (internal_error and endpoint-specific 5xx codes). Retryable.