---
title: Poll for and mint the CLI access token (RFC 8628)
description: Public.
api_method: POST
api_path: "/v1/auth/cli/token"
canonical_url: https://wiblo.app/docs/developers/api/cli/create-cli-device-token
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/cli/create-cli-device-token.md
---

# Poll for and mint the CLI access token (RFC 8628)

`POST /v1/auth/cli/token`

Public. The CLI polls this with the `device_code`; the first poll after approval mints and returns the raw `wbl_user_*` access token (the only moment it exists outside the CLI). **This is the only endpoint in the API that returns the RFC 8628 OAuth wire shape** — both success and the 400 polling/error responses use the OAuth shapes (`DeviceTokenSuccess` / `DeviceTokenRfcError`), NOT the wiblo error envelope. `expires_in` is always `null` ("until revoked") per adr/0004. Rate-limited per device code + IP at 30/min.

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `grant_type` | `"urn:ietf:params:oauth:grant-type:device_code"` | Yes |  |
| `device_code` | `string` | Yes |  |
| `client_id` | `string` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/auth/cli/token \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
  "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
  "device_code": "...",
  "client_id": "..."
}'
```

**TypeScript**

```ts
import { createSdk, createCliDeviceToken } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await createCliDeviceToken({
  client: sdk,
  body: {
    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
    "device_code": "...",
    "client_id": "..."
  },
})
```

## Responses

**`200`** — Access token minted (RFC 8628 success shape). Returned once, on the first poll after approval. Returns `DeviceTokenSuccess`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `access_token` | `string` | Yes |  |
| `token_type` | `"Bearer"` | Yes |  |
| `expires_in` | `null` | Yes |  |

**`400`** — RFC 8628 OAuth error shape (NOT the wiblo envelope). `error` is one of `authorization_pending`, `slow_down`, `access_denied`, `expired_token`, `invalid_grant`, `invalid_client`. A non-standard `request_id` is included for log correlation. Returns `DeviceTokenRfcError`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.