Collect a CLI sign-in's token

POST/v1/cli/device/token

Poll this with the device code from /v1/cli/device/code every interval seconds. Until the developer decides, it answers authorization_pending. Once they approve, it returns a device token, exactly once.

Answers in OAuth's own shape (RFC 6749 section 5, RFC 8628 section 3.5), not the Varis error envelope, so any device-flow client reads it. Stop polling on access_denied, expired_token, or invalid_grant.

Unauthenticated: the device code is the credential.

Body

application/json

device_codestringrequired

Response

application/json

Approved. Store the token; it is never shown again.

access_tokenstringrequired

The device token. Send it as Authorization: Bearer on management requests. Store it outside the repository; the CLI keeps it in ~/.config/varis/credentials.toml.

token_typestringrequired

expires_inintegerrequired

Seconds until the token expires if unused: 180 days. Every request that uses it pushes the expiry forward.

request_idstringrequired

curl -X POST 'https://api.usevaris.com/v1/cli/device/token' \  -H 'Content-Type: application/json' \  -d '{  "device_code": "string"}'

{  "access_token": "string",  "token_type": "Bearer",  "expires_in": 0,  "request_id": "string"}