CLI pairing

The browser pairing flow behind `renza login`: start a pairing, approve it in the browser on the auth origin, poll to collect the minted org-scoped key. Documented for completeness — the CLI drives this for you.

Begin CLI browser pairing

POST/v1/public/auth/cli/start

Public. Starts a device pairing for `renza login`: returns a secret `device_code` (poll with it) and a short `user_code` + browser URL where the user approves it — minting a user key that acts as them.

Public — no authentication required. Supports idempotency keys.

Powers the `renza login` browser pairing flow; not called directly.

Returns

201The started pairing.

Failures use the standard error envelope with a closed set of codes.

POST /v1/public/auth/cli/start

curl https://api.renza.io/v1/public/auth/cli/start \
  -X POST

Response 201

{
  "device_code": "x7Qk9v…",
  "user_code": "BCDF-2345",
  "verification_uri": "https://renza.io/cli",
  "verification_uri_complete": "https://renza.io/cli?code=BCDF2345",
  "interval": 5,
  "expires_in": 600
}

Poll a CLI pairing

POST/v1/public/auth/cli/poll

Public. The CLI polls with its `device_code`. While the user hasn't acted → `pending`; once approved → `approved` with the one-time `api_key` (the pairing is then consumed); else `denied` / `expired`.

Public — no authentication required. Supports idempotency keys.

Powers the `renza login` browser pairing flow; not called directly.

Body parameters

device_codestringrequired

Returns

200The current pairing status (and the key once approved).

Failures use the standard error envelope with a closed set of codes.

POST /v1/public/auth/cli/poll

curl https://api.renza.io/v1/public/auth/cli/poll \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
  "device_code": "x7Qk9v…"
}'

Response 200

{
  "status": "pending",
  "api_key": "rza_sk_live_…",
  "org": "org_8KxQ2v…"
}