> ## Documentation Index
> Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve or deny a device authorization

> Browser-initiated: the signed-in human resolves a user_code and approves (binding the ceremony to themselves) or denies.



## OpenAPI

````yaml /api-reference/oauth-openapi.json post /oauth/device
openapi: 3.0.0
info:
  title: Nevermined Authentication API
  description: >-
    The OAuth 2.1 + RFC 8628 device-flow ceremony and standards-based discovery
    endpoints an agent or connector uses to obtain and manage a Nevermined
    credential. These endpoints are root-mounted (not under /api/v1).
  version: 1.0.0
  contact: {}
servers:
  - url: https://api.sandbox.nevermined.app
    description: Sandbox
  - url: https://api.live.nevermined.app
    description: Live
security: []
tags:
  - name: Authentication - Ceremony
    x-group: Ceremony
    description: Authorization Code (PKCE) and RFC 8628 device grant.
  - name: Authentication - Connections
    x-group: Connections
    description: AgentBindings — the consent receipts a user manages.
  - name: Authentication - Discovery
    x-group: Discovery
    description: RFC 8414 / 9728 / JWKS metadata.
paths:
  /oauth/device:
    post:
      tags:
        - Authentication - Ceremony
      summary: Approve or deny a device authorization
      description: >-
        Browser-initiated: the signed-in human resolves a user_code and approves
        (binding the ceremony to themselves) or denies.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceVerificationRequest'
      responses:
        '204':
          description: Recorded (approved or denied)
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
      security:
        - bearerAuth: []
components:
  schemas:
    DeviceVerificationRequest:
      type: object
      required:
        - user_code
        - approve
      properties:
        user_code:
          type: string
          example: BCDF-GHJK
          description: Hyphens and case are ignored.
        approve:
          type: boolean
          example: true
          description: true to approve (bind to the caller); false to deny.
    ErrorEnvelope:
      type: object
      properties:
        code:
          type: string
          example: BCK.OAUTH.0016
        message:
          type: string
          example: Unknown OAuth client
        category:
          type: string
          enum:
            - validation
            - auth
            - business
            - integration
            - internal
          example: auth
        hint:
          type: string
          nullable: true
        retryable:
          type: boolean
          nullable: true
          description: When present, whether retrying the same request may succeed.
        httpStatus:
          type: integer
          example: 400
  responses:
    Error:
      description: Typed error envelope
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Nevermined API key
      description: >-
        A Nevermined API key: `Authorization: Bearer <sandbox:… | live:…>`.
        Environment-prefixed, not a bare JWT — send the whole string.

````

## Related topics

- [RFC 8628 device authorization request](/docs/api-reference/authentication--ceremony/rfc-8628-device-authorization-request.md)
- [Device Flow (RFC 8628)](/docs/integrate/authentication/device-flow.md)
- [Authorization Code + PKCE](/docs/integrate/authentication/oauth-authorization-code.md)
- [Authentication & Identity](/docs/integrate/authentication/overview.md)
- [Authentication for AI Agents](/docs/integrate/authentication/for-agents.md)