Verify

Verify Authorized Device

put

Verifies an OAuth2 authorized device using its unique user code.

This endpoint implements the web user authorization step in the OAuth2 device authorization grant flow as defined in https://tools.ietf.org/html/rfc8628. It is called from the dashboard to verify an OAuth device using its user code.

The request is expected to contain at least the user code. Optionally, the trusted device flag can be set to indicate that the device is trusted and will not require a re-verification in the near future. Additionally, the dashboard may set metadata fields to store additional information about the device that will be passed to the client at the end of the device authorization flow (e.g. a default workspace ID to be pre-selected).

If the user code is valid, the device is marked as verified and associated with the user that authorized the device. This association is required to be able to issue access tokens or revoke the device later on. The user code is invalidated and cannot be used for further authorizations.

Args: request: The model containing the verification request. user: The authorized user. user_manager: The user manager.

Returns: The updated OAuth2 authorized device object.

Authorizations

OAuth2clientCredentialsRequired

Token URL:

---

OAuth2authorizationCodeRequired

Authorization URL: Token URL: Refresh URL:

Body

OAuth2 device authorization verification request.

user_codestringRequired

trusted_devicebooleanOptionalDefault: false

Responses

200

Successful Response

application/json

Response body for OAuth2 devices.

idstring · uuidRequired

The OAuth2 device ID.

namestring · nullableOptional

The name of the OAuth2 device.

createdstring · date-timeRequired

The creation date of the OAuth2 device.

updatedstring · date-timeRequired

The date the OAuth2 device was last updated.

user_idstring · uuid · nullableOptional

The user ID owning the OAuth2 device.

client_idstring · uuidRequired

The client ID of the OAuth2 device.

expiresstring · date-timeRequired

The expiration date of the OAuth2 device after which the device can no longer be used in the OAuth2 authorized device flow.

trusted_devicebooleanRequired

Whether the OAuth2 device was marked as trusted. A trusted device has a much longer validity time.

statusstring · enumRequired

The status of the OAuth2 device.

Possible values:

osstring · nullableOptional

The operating system of the device used for authentication.

ip_addressstring · nullableOptional

The IP address of the device used for authentication.

hostnamestring · nullableOptional

The hostname of the device used for authentication.

citystring · nullableOptional

The city where the device is located.

regionstring · nullableOptional

The region where the device is located.

countrystring · nullableOptional

The country where the device is located.

last_loginstring · date-time · nullableOptional

The date of the last successful login.

422

Validation Error

application/json

put/devices/verify

PUT /devices/verify HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 96

{
  "user_code": "text",
  "trusted_device": false,
  "device_metadata": {
    "ANY_ADDITIONAL_PROPERTY": "text"
  }
}

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "text",
  "created": "2026-01-01T00:00:00.000Z",
  "updated": "2026-01-01T00:00:00.000Z",
  "user_id": "123e4567-e89b-12d3-a456-426614174000",
  "client_id": "123e4567-e89b-12d3-a456-426614174000",
  "expires": "2026-01-01T00:00:00.000Z",
  "trusted_device": true,
  "status": "pending",
  "os": "text",
  "ip_address": "text",
  "hostname": "text",
  "city": "text",
  "region": "text",
  "country": "text",
  "last_login": "2026-01-01T00:00:00.000Z",
  "device_metadata": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  }
}