POST	/api/auth/device/authorize
POST	/api/auth/device/poll
POST	/api/auth/device/approve
POST	/api/auth/device/deny

Start RFC 8628 device flow

POST/api/auth/device/authorize

Authentication: none.
Rate limit: 10 requests per minute per IP address.

Request body

Name	Type	Required	Notes
org_slug	string	Yes
client_id	string	No
scope	string	No

curl -X POST "https://shellius.example.com/api/auth/device/authorize" \
  -H "Content-Type: application/json" \
  -d '{
    "org_slug": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Poll device flow for tokens

POST/api/auth/device/poll

Authentication: none.
Rate limit: 30 requests per minute per IP address.

Request body

Name	Type	Required	Notes
device_code	string	Yes

curl -X POST "https://shellius.example.com/api/auth/device/poll" \
  -H "Content-Type: application/json" \
  -d '{
    "device_code": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Approve a device code

POST/api/auth/device/approve

Authentication: bearer token.
Permission: any signed-in user.
Rate limit: 5 requests per 15 minutes per IP address.

Request body

Name	Type	Required	Notes
user_code	string	Yes

curl -X POST "https://shellius.example.com/api/auth/device/approve" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_code": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Deny a device code

POST/api/auth/device/deny

Authentication: bearer token.
Permission: any signed-in user.
Rate limit: 5 requests per 15 minutes per IP address.

Request body

Name	Type	Required	Notes
user_code	string	Yes

curl -X POST "https://shellius.example.com/api/auth/device/deny" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_code": "…"
  }'

200 OK

{ "success": true, "data": { … } }