Activate a device

An agent or command-line tool asked for access to your APIs.io account. It showed you a code. Enter it below, check what it is asking for, and approve it.

Nothing long-lived is handed to the tool. It receives a scoped token that expires — you are never asked to copy an API key into a chat window, which is the thing this flow exists to replace.

Loading…

For the tool builder

This is RFC 8628, the OAuth device authorization grant. Register a client once, then:

Code
POST /api/v1/auth/device
     client_id=<your client_id>&scope=apis:read

→ { "device_code": "…", "user_code": "WDJB-MJHT",
    "verification_uri": "https://apis.io/developer/activate",
    "verification_uri_complete": "https://apis.io/developer/activate?user_code=WDJB-MJHT",
    "expires_in": 900, "interval": 5 }

Show your human verification_uri_complete, then poll:

Code
POST /api/v1/auth/token
     grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=…&client_id=…

400 authorization_pending   keep polling, no faster than `interval`
400 slow_down               add 5 seconds and keep polling
400 access_denied           they said no — stop
400 expired_token           the 15 minutes ran out — start again
200 { "access_token": … }

The token carries the tier of the human who approved it, not your client's. Everything is advertised in the AS metadata, so a standard OAuth library can discover this flow without reading this page.