Device Login
Start a device login flow. Returns a code the user enters in the dashboard.
This endpoint is unauthenticated by design — the daemon has no credentials yet — so the initiator has no verifiable identity. We capture the caller’s IP and user-agent and surface them (plus the unverified, caller-supplied labels) on the approval page so the approving admin can spot a request they did not start. The real anti-phishing guard lives in the approval UI copy and the short as_admin token lifetime; see ENG-2561.
Authorizations
API Key or JWT User Token. If using an API Key, set the X-As-User header to act as a specific user. A JWT User Token is always scoped to a specific user.
Optionally set this header to act as a specific user when using an API Key, equivalent to first exchanging the API Key for a User Token