Approve a pending CLI device code from the browser

POST

/api/v1/cli-auth/approve

Code sample: cURL

curl -X POST 'https://dashboard.justcrawl.io/api/v1/cli-auth/approve' \
  -H 'Authorization: Bearer $JUSTCRAWL_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user_code":"ABCD-EFGH"}'

• Production

Browser-side leg of the device-authorization flow. Mints a new API key bound to the calling user’s org (named jc CLI on <hostname>) and attaches the plaintext key to the cli_auth_codes row so the CLI’s next /cli-auth/poll receives it. Lateral-movement defense: this endpoint refuses Bearer-token (sr_live_*) auth — only a browser JWT can approve a CLI session. That blocks an attacker holding a leaked API key from minting a second persistent key with a benign-looking name. Race-safe: if a concurrent expiry/approval wins between the pre-check and the UPDATE, the minted key is kept (caller can delete it from the dashboard) and a 410 is returned so the UI can retry.

Authorizations

• bearerAuth

Request Body ^required

Media type application/json

object

user_code

required

string

Example ^generated

{
  "user_code": "example"
}

Responses

200

Approved. Body echoes hostname so the dashboard can render confirmation.

Media type application/json

object

ok

boolean

hostname

string

Example

{
  "ok": true
}

400

Validation failed — request body or query is missing/invalid

Media type application/json

object

error

string

Example

{
  "error": "Missing or invalid \"url\" field"
}

401

Missing or invalid authentication token

Media type application/json

object

error

string

Example

{
  "error": "Missing or invalid authentication token"
}

403

Browser JWT required — API-key Bearer auth is refused here (lateral-movement defense).

404

Unknown user_code.

410

Code expired or already used (includes the post-race lost-update case).

500

Unexpected server error. Logs and PostHog $exception capture

Media type application/json

object

error

string

Example

{
  "error": "Something went wrong"
}