Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccount

Approve a device login

Approves a pending device login, giving the CLI a 30-day session as you in the chosen org with your membership role. Needs a signed-in user session. The session has the same permissions your dashboard session has in that org, including session-only actions an API key can never perform.

Required permission

Requires the self.update permission. See Permissions for the roles and API key permissions that include it.

POST
/v1/cli-auth/device/{userCode}/approve

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

userCode*string
Match^[0-9]{6}$

Request Body

application/json
  1. body
orgId*string

Response Body

Approved

Example Request
curl -X POST 'https://api.openrelay.inc/v1/cli-auth/device/string/approve' \  -H 'Content-Type: application/json' \  -d '{  "orgId": "string"}'
Example Response
Empty

Look up a pending device login GET

Shows the approval page what a pending device login is: the requesting device's name, the IP that started the flow and when. User sessions only. Approving or denying a CLI login is something only a signed-in person does, so an API key can never call this. Rate limited per user and per IP, the brute-force mitigation for a guessed 6-digit code.

Deny a pending device login (session only) POST

Marks the code denied; the polling CLI gets access_denied and stops. Irreversible for that code (a fresh `orl auth login` starts a new one).