---
title: Approve or deny a CLI device-flow request
description: "Session-only — a real human session must approve; any wbl_* bearer is rejected with INSUFFICIENT_PRIVILEGE."
api_method: POST
api_path: "/v1/auth/cli/approve"
canonical_url: https://wiblo.app/docs/developers/api/cli/approve-cli-device-code
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/cli/approve-cli-device-code.md
---

# Approve or deny a CLI device-flow request

`POST /v1/auth/cli/approve`

Session-only — a real human session must approve; any `wbl_*` bearer is rejected with `INSUFFICIENT_PRIVILEGE`. Marks the device code approved (or denied); no token is minted here. The token is minted later when the CLI polls `/v1/auth/cli/token`. Per-user rate-limited at 30/60s.

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `user_code` | `string` | Yes |  |
| `decision` | `"approve" \| "deny"` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/auth/cli/approve \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "user_code": "...",
  "decision": "approve"
}'
```

**TypeScript**

```ts
import { createSdk, approveCliDeviceCode } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await approveCliDeviceCode({
  client: sdk,
  body: {
    "user_code": "...",
    "decision": "approve"
  },
})
```

## Responses

**`200`** — The device code is now approved or denied. Returns `ApproveDeviceCodeResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `ok` | `true` | Yes |  |

**`400`** — Body failed Zod validation (`VALIDATION_FAILED`). Returns `ApiErrorEnvelope`.

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — A `wbl_*` bearer was presented to a session-only route (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — No device-flow request matches the `user_code` (`DEVICE_CODE_NOT_FOUND`). Returns `ApiErrorEnvelope`.

**`409`** — The device code is no longer pending (`DEVICE_CODE_USED`). Returns `ApiErrorEnvelope`.

**`410`** — The device code has expired (`DEVICE_CODE_EXPIRED`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.