Auth API

What the auth endpoints are for

Getting a key onto a machine that has no browser, without anyone pasting a secret into a terminal or a chat window. This is the standard device-code flow from RFC 8628, the same pattern a TV app uses when it shows you a short code to type on your phone.

These two endpoints are the only unauthenticated ones in the API, for the obvious reason that a client using them does not have a key yet. Start a login, show the user the code, poll until they approve it, and receive the key once.

curl -X POST https://app.makeaivideo.ai/api/v1/auth/device \
  -H "Content-Type: application/json" \
  -d '{ "client_name": "my-laptop" }'

Auth API questions

How do I log in from a machine with no browser?

Use the device-code flow. POST /auth/device returns a short user code and a URL, the person approves it in a browser anywhere, and your client polls POST /auth/device/token until it receives the key.

How often should I poll for approval?

At the interval the start response returns, not one you choose. Polling faster gets a slow_down status telling you to back off.

Can I retrieve the API key again later?

No. The key is returned once, on the authorized response, and is never retrievable afterwards, so write it to your config or keychain immediately.