Skip to content
SupaCloud Docs
Select themeSelect language

POST /settings/oauth/:provider/device/start — begin a device-code flow.

POST
/api/settings/oauth/{provider}/device/start
curl --request POST \
  --url https://example.com/api/settings/oauth/example/device/start \
  --header 'Content-Type: application/json' \
  --cookie supacloud_session=<supacloud_session> \
  --data '{ "scope": "example", "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
provider
required
string

Device-code OAuth provider name (copilot)

Request Body

Section titled “Request Body”

Optional scope/workspace override

Media typeapplication/json
One of:
null
Examplegenerated
{
  "scope": "example",
  "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Responses

Section titled “Responses”

200

Section titled “200”

Device-code flow started: the user_code + verification_uri to show the user, and the poll handle

Media typeapplication/json

The device-flow start response: the user_code + verification_uri the user enters at GitHub, the opaque state handle the FE polls with, and the interval/expires_in GitHub dictates for the poll cadence.

object
expires_in
required
integer format: int64
interval
required
integer format: int64
state
required
string
user_code
required
string
verification_uri
required
string
Examplegenerated
{
  "expires_in": 1,
  "interval": 1,
  "state": "example",
  "user_code": "example",
  "verification_uri": "example"
}

400

Section titled “400”

Structured client error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}