Skip to main content
POST
RFC 8628 device authorization request

Body

application/json
client_id
string
required

Pre-registered connector (unregistered → BCK.OAUTH.0016).

Example:

"fleet"

agent_id
string
required

Target agent — required today (absent → BCK.OAUTH.0018).

Example:

"agent-123"

resource
string | null

RFC 8707 resource (audience) — SELECTS the credential. For the usual device-flow goal (an NVM API key), either omit it or use this API's host, as in the example; a NON-API resource makes the exchange mint an x402 permission instead, which fails with BCK.OAUTH.0008 if the binding has no delegation.

Example:

"https://api.nevermined.app"

scope
string | null
Example:

"openid"

Response

Device + user codes

device_code
string

Machine secret the agent polls with (opaque).

user_code
string
Example:

"BCDF-GHJK"

verification_uri
string
Example:

"https://nevermined.app/oauth/device"

verification_uri_complete
string
Example:

"https://nevermined.app/oauth/device?user_code=BCDF-GHJK"

expires_in
integer
Example:

600

interval
integer

Minimum seconds between token polls.

Example:

5