> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Device Authorization

> Begin a device authorization flow for a browserless or sandboxed client. A human approves the short pairing code on the dashboard while the client polls the token endpoint.



## OpenAPI

````yaml /openapi.json post /v1/agent-auth/device-authorizations
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/agent-auth/device-authorizations:
    post:
      tags:
        - agentAuth
      summary: Create Device Authorization
      description: >-
        Begin a device authorization flow for a browserless or sandboxed client.
        A human approves the short pairing code on the dashboard while the
        client polls the token endpoint.
      operationId: agentAuth.createDeviceAuthorization
      parameters: []
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                clientId:
                  type: string
                  enum:
                    - korve-cli
                    - korve-mcp
                audience:
                  type: string
                  enum:
                    - cli
                    - mcp
                  description: >-
                    The first-party client surface that may present the
                    resulting token.
                scopes:
                  type: array
                  minItems: 1
                  maxItems: 256
                  items:
                    type: string
                    pattern: ^[A-Za-z][A-Za-z0-9]*\.[A-Za-z][A-Za-z0-9]*$
                    maxLength: 128
                  description: Exact public API operation ids the grant may call.
                requestedRole:
                  type: string
                  enum:
                    - member
                    - admin
                  description: >-
                    Maximum organization role the grant may exercise. Owner
                    grants do not exist.
              required:
                - clientId
                - audience
                - scopes
                - requestedRole
      responses:
        '201':
          description: >-
            Device authorization created. Show the user code, then poll the
            token endpoint with the device code.
          content:
            application/json:
              schema:
                type: object
                properties:
                  deviceCode:
                    type: string
                    description: >-
                      Client-held polling secret; never shown to the approving
                      user.
                  userCode:
                    type: string
                    pattern: ^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$
                    maxLength: 9
                    description: >-
                      Human-entered pairing code in XXXX-XXXX form, from an
                      unambiguous alphabet.
                  verificationUri:
                    type: string
                    format: uri
                  verificationUriComplete:
                    type: string
                    format: uri
                    description: The verification page with the user code pre-filled.
                  expiresIn:
                    type: integer
                    minimum: 1
                  interval:
                    type: integer
                    minimum: 1
                    description: Minimum seconds between token polls.
                required:
                  - deviceCode
                  - userCode
                  - verificationUri
                  - verificationUriComplete
                  - expiresIn
                  - interval
        '422':
          description: Invalid client, audience, scope, or role.
        '429':
          description: Too many device authorization attempts from this network source.
      security: []

````