Start an OAuth device authorization flow (RFC 8628 §3.1)
Use when: caller is a CLI / IDE plugin / MCP server starting a device-flow login — server returns a device_code (long, opaque) + user_code (short, human-typeable) plus the verification URL where the user lands to approve
No auth required — this is how a client without credentials initiates one. Returns the device_code (the polling credential), the user_code (the human-typed identifier), the verification_uri, the expires_in (TTL in seconds), and the interval (polling cadence).
Authorizations
Verlon API key (newly minted keys are prefixed sk-vrln-; legacy verlon_* and layer_* keys from prior prefix migrations continue to validate). Generated from the dashboard under Settings → API Keys, or via verlon key create in the CLI.
Body
Response
Device authorization issued.

