> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperspell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Login

> Start a device login flow. Returns a code the user enters in the dashboard.

This endpoint is unauthenticated by design — the daemon has no credentials
yet — so the initiator has no verifiable identity. We capture the caller's
IP and user-agent and surface them (plus the unverified, caller-supplied
labels) on the approval page so the approving admin can spot a request they
did not start. The real anti-phishing guard lives in the approval UI copy
and the short as_admin token lifetime; see ENG-2561.



## OpenAPI

````yaml https://app.stainlessapi.com/api/spec/documented/hyperspell.yaml post /auth/device-login
openapi: 3.1.0
info:
  title: Hyperspell API
  summary: >-
    Hyperspell is the memory layer for AI apps and agents. Through the API, you
    can add memories, connect data sources to index them in real-time, and
    search memories with our natural language query engine.
  termsOfService: https://hyperspell.com/blog/tos
  contact:
    name: Hyperspell
    url: https://hyperspell.com/
    email: hello@hyperspell.com
  version: 0.32.1
servers:
  - url: https://api.hyperspell.com
    description: Production
security:
  - APIKey: []
    AsUser: []
paths:
  /auth/device-login:
    post:
      tags:
        - Device Auth
      summary: Device Login
      description: >-
        Start a device login flow. Returns a code the user enters in the
        dashboard.


        This endpoint is unauthenticated by design — the daemon has no
        credentials

        yet — so the initiator has no verifiable identity. We capture the
        caller's

        IP and user-agent and surface them (plus the unverified, caller-supplied

        labels) on the approval page so the approving admin can spot a request
        they

        did not start. The real anti-phishing guard lives in the approval UI
        copy

        and the short as_admin token lifetime; see ENG-2561.
      operationId: device_login_auth_device_login_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceLoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceLoginResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    DeviceLoginRequest:
      properties:
        app_slug:
          type: string
          title: App Slug
        device_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Device Name
        requester_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Requester Name
        admin:
          type: boolean
          title: Admin
          default: false
      type: object
      required:
        - app_slug
      title: DeviceLoginRequest
    DeviceLoginResponse:
      properties:
        device_code:
          type: string
          title: Device Code
        login_url:
          type: string
          title: Login Url
        poll_interval:
          type: integer
          title: Poll Interval
          default: 2
        expires_in:
          type: integer
          title: Expires In
          default: 600
      type: object
      required:
        - device_code
        - login_url
      title: DeviceLoginResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    APIKey:
      type: http
      description: >-
        API Key or JWT User Token. If using an API Key, set the X-As-User header
        to act as a specific user. A JWT User Token is always scoped to a
        specific user.
      scheme: bearer
      bearerFormat: Bearer <token>
    AsUser:
      type: apiKey
      description: >-
        Optionally set this header to act as a specific user when using an API
        Key, equivalent to first exchanging the API Key for a User Token
      in: header
      name: X-As-User

````