Request a device code
Step one of RFC 8628 device authorization, and the way a terminal bridge pairs with a Relay account. No authentication; show the returned user_code (and a QR of verification_uri_complete) to the person, then poll POST /api/auth/device/token every interval seconds. Codes expire after expires_in seconds.
The person must open the verification URI before approving. That read is what binds the pending request to their account; approving a code nobody has opened answers 400 invalid_request.
Body
Response
Codes issued; show the user code and start polling.
The bridge's secret half. Never show it to the person.
The short code the person types into the Relay app.
"ABCD-EFGH"
The same URI with the user code embedded, for a QR or a deep link.
Seconds until the codes stop being claimable.
600
Minimum seconds between token polls.
5

