Claim a pairing code
Exchanges a pairing secret for a long-lived device token. Unauthenticated by necessity and rate limited hard. Wrong, expired, and already-claimed codes all answer identically, so a caller with no credential learns nothing from the difference.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/api/pair/claim" \ -H "Content-Type: application/json" \ -d '{ "secret": "string" }'{ "token": "string", "expiresAt": "2019-08-24T14:15:22Z", "device": { "id": "string", "name": "string", "platform": "string", "createdAt": "2019-08-24T14:15:22Z", "lastSeenAt": "2019-08-24T14:15:22Z", "expiresAt": "2019-08-24T14:15:22Z", "current": true }, "user": { "id": "string", "username": "string", "role": "viewer", "disabled": true, "twoFactor": true }, "server": { "serverId": "string", "serverName": "string", "version": "string" }}Pair this client directly POST
Issues a device token to the signed-in caller, for the path where the user typed the server address and signed in rather than scanning a code. Requires a signed-in session. Requires the **viewer** role.
Mint a pairing code POST
Creates a single-use code, claimable for five minutes, and the offer URL the dashboard renders as a QR code. The secret travels in the URL fragment so it never reaches a server log. Requires a signed-in session: a paired device may not mint another code, which is what stops a stolen phone from cloning itself. Requires the **viewer** role. An optional client UUID lets the caller check or cancel the exact code after a lost response. Reusing an existing UUID never reissues its secret.