Polls a started sign-in, and collects its API token once approved.
The token is handed over once. The request is gone after that, so a
second poll gets device_code_unusable.
Errors
400 with device_authorization_pending while nobody has answered, and
with device_code_unusable when the code is unknown, expired or already
redeemed. 403 with device_authorization_denied when the person refused.
404 when this instance has no accounts.
application/json- body
Body of POST /auth/device/token.
device_code*stringThe device code from POST /auth/device.
Approved; the token's secret is shown only here
application/json- response
A newly issued token. The only response that ever carries the secret.
created_at*stringWhen it was issued, RFC 3339.
display_prefix*stringLeading characters of the secret, so a person can tell two tokens apart without the service having to store either of them.
expires_at?|When it stops being accepted, or null to live until revoked.
id*stringStable identifier; what DELETE /tokens/{id} takes.
last_used_at?|When it was last accepted, if ever.
name*stringWhat the owner called it.
permissions*array<string>What it may do, as resource:verb strings.
What it was minted with, not what it can do right now. Those differ when the owner has since been demoted, and the owner is who this list is for. Sending the narrowed set instead would make a token look as though it had been quietly edited.
revoked_at?|When it was revoked, if it was.
secret*stringThe secret, in full.
Shown once. Only its SHA-256 digest is stored, so this value cannot be recovered, so a client that does not keep it must issue another token.
curl -X POST 'https://example.com/api/v1/auth/device/token' \ -H 'Content-Type: application/json' \ -d '{ "device_code": "string"}'{ "created_at": "string", "display_prefix": "string", "expires_at": "string", "id": "string", "last_used_at": "string", "name": "string", "permissions": [ "string" ], "revoked_at": "string", "secret": "string"}