@workos/mcp-docs-server 0.1.0 → 0.2.0

package/.docs/organized/docs/reference/{user-management → authkit}/authentication/refresh-and-seal-session-data.mdx

@@ -3,7 +3,7 @@ reference:
   js:
     - key: refreshAndSealSessionData
       id: refresh_and_seal_session_data
-      url: /reference/user-management/authentication/refresh-and-seal-session-data
+      url: /reference/authkit/authentication/refresh-and-seal-session-data
       title: userManagement.refreshAndSealSessionData()
       parameters:
         - key: options
@@ -37,12 +37,12 @@ reference:
                 The reason authentication failed. Only present if `authenticated
                 = false`.
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication/refresh-and-seal-session-data.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication/refresh-and-seal-session-data.mdx
 ---
 
 ## Refresh and seal session data
 
-Unseals the provided session data from a user's session cookie, [authenticates with the existing refresh token](/reference/user-management/authentication/refresh-token), and returns the sealed data for the refreshed session.
+Unseals the provided session data from a user's session cookie, [authenticates with the existing refresh token](/reference/authkit/authentication/refresh-token), and returns the sealed data for the refreshed session.
 
 <CodeBlock referenceId="refresh_and_seal_session_data">
   <CodeBlockTab title="Request" file="refresh-and-seal-session-data-request" />

package/.docs/organized/docs/reference/{user-management → authkit}/authentication/refresh-token.mdx

@@ -7,8 +7,8 @@ descriptions:
 
       session is not authorized for the organization, an appropriate
 
-      [authentication error](/reference/user-management/authentication-errors)
-      will be returned.
+      [authentication error](/reference/authkit/authentication-errors) will be
+      returned.
 
 
       If no organization ID is provided, then the access token will default to
@@ -19,7 +19,7 @@ reference:
   curl:
     - key: authenticate-refresh-token
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: /user_management/authenticate
       type: POST
       parameters:
@@ -58,7 +58,7 @@ reference:
             - key: organization_id
               type: string
               optional: true
-              description: (authentication.organization_id)
+              description: (refresh_token_authentication.organization_id)
             - key: access_token
               type: String
               optional: false
@@ -69,8 +69,8 @@ reference:
               optional: false
               description: >
                 [Exchange this
-                token](/reference/user-management/authentication/refresh-token)
-                for a new access token.
+                token](/reference/authkit/authentication/refresh-token) for a
+                new access token.
             - key: authentication_method
               type: >-
                 "SSO" | "Password" | "AppleOAuth" | "GitHubOAuth" |
@@ -91,7 +91,7 @@ reference:
   js:
     - key: authenticateWithRefreshToken
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: userManagement.authenticateWithRefreshToken()
       parameters:
         - key: options
@@ -139,7 +139,7 @@ reference:
             - key: organizationId
               type: string
               optional: true
-              description: (authentication.organization_id)
+              description: (refresh_token_authentication.organization_id)
             - key: accessToken
               type: string
               optional: false
@@ -150,8 +150,8 @@ reference:
               optional: false
               description: >
                 [Exchange this
-                token](/reference/user-management/authentication/refresh-token)
-                for new access tokens.
+                token](/reference/authkit/authentication/refresh-token) for new
+                access tokens.
             - key: authenticationMethod
               type: >-
                 "SSO" | "Password" | "AppleOAuth" | "GitHubOAuth" |
@@ -176,7 +176,7 @@ reference:
   python:
     - key: authenticate_with_refresh_token
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: user_management.authenticate_with_refresh_token()
       parameters:
         - key: refresh_token
@@ -208,7 +208,7 @@ reference:
   go:
     - key: AuthenticateWithRefreshToken
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: usermanagement.AuthenticateWithRefreshToken()
       parameters:
         - (ctx)
@@ -249,7 +249,7 @@ reference:
   ruby:
     - key: authenticate_with_refresh_token
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: UserManagement.authenticate_with_refreshToken()
       parameters:
         - key: client_id
@@ -285,7 +285,7 @@ reference:
   java:
     - key: authenticateWithRefreshToken
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: userManagement.authenticateWithRefreshToken()
       parameters:
         - key: client_id
@@ -329,7 +329,7 @@ reference:
   php:
     - key: authenticateWithRefreshToken
       id: authenticate_with_refresh_token
-      url: /reference/user-management/authentication/refresh-token
+      url: /reference/authkit/authentication/refresh-token
       title: $userManagement->authenticateWithRefreshToken()
       parameters:
         - key: clientID
@@ -362,12 +362,12 @@ reference:
               type: string
               description: (authentication.refresh_token)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication/refresh-token.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication/refresh-token.mdx
 ---
 
 ## Authenticate with refresh token
 
-Use this endpoint to exchange a refresh token for a new access token. Refresh tokens are single use, so a new refresh token is returned.
+Use this endpoint to exchange a refresh token for a new access token. Refresh tokens may be rotated after use, so a replacement refresh token is also provided.
 
 <CodeBlock referenceId="authenticate_with_refresh_token">
   <CodeBlockTab

package/.docs/organized/docs/reference/{user-management → authkit}/authentication/session-cookie.mdx

@@ -11,7 +11,7 @@ reference:
   js:
     - key: authenticateWithSessionCookie
       id: authenticate_with_session_cookie
-      url: /reference/user-management/authentication/session-cookie
+      url: /reference/authkit/authentication/session-cookie
       title: userManagement.authenticateWithSessionCookie()
       parameters:
         - key: options
@@ -43,6 +43,10 @@ reference:
               type: string
               optional: true
               description: (access_token.role)
+            - key: roles
+              type: array
+              optional: true
+              description: (access_token.roles)
             - key: permissions
               type: string
               optional: true
@@ -56,12 +60,12 @@ reference:
                 The reason authentication failed. Only present if `authenticated
                 = false`.
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication/session-cookie.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication/session-cookie.mdx
 ---
 
 ## Authenticate with session cookie
 
-Authenticates a user using an AuthKit session cookie. This method does not make a network call, but simply unseals an existing session cookie and decodes the JWT claims from the [access token](/reference/user-management/session-tokens/access-token).
+Authenticates a user using an AuthKit session cookie. This method does not make a network call, but simply unseals an existing session cookie and decodes the JWT claims from the [access token](/reference/authkit/session-tokens/access-token).
 
 <CodeBlock referenceId="authenticate_with_session_cookie">
   <CodeBlockTab

package/.docs/organized/docs/reference/{user-management → authkit}/authentication/totp.mdx

@@ -11,7 +11,7 @@ reference:
   curl:
     - key: authenticate_mfa_totp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: /user_management/authenticate
       type: POST
       parameters:
@@ -62,7 +62,7 @@ reference:
   js:
     - key: authenticateWithTotp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: userManagement.authenticateWithTotp()
       parameters:
         - key: clientId
@@ -122,7 +122,7 @@ reference:
   python:
     - key: authenticate_with_totp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: user_management.authenticate_with_totp()
       parameters:
         - key: code
@@ -165,7 +165,7 @@ reference:
   go:
     - key: AuthenticateWithTOTP
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/magic-totp
+      url: /reference/authkit/authentication/totp
       title: usermanagement.AuthenticateWithTOTP()
       parameters:
         - (ctx)
@@ -209,7 +209,7 @@ reference:
   php:
     - key: authenticateWithTotp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: $userManagement->authenticateWithTotp()
       parameters:
         - key: clientId
@@ -247,7 +247,7 @@ reference:
   ruby:
     - key: authenticate_with_totp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: UserManagement.authenticate_with_totp()
       parameters:
         - key: client_id
@@ -285,7 +285,7 @@ reference:
   java:
     - key: authenticateWithTotp
       id: authenticate_mfa_totp
-      url: /reference/user-management/authentication/mfa-totp
+      url: /reference/authkit/authentication/totp
       title: userManagement.authenticateWithTotp()
       parameters:
         - key: clientId
@@ -350,16 +350,16 @@ reference:
                   optional: true
                   description: (authentication.impersonator.reason)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication/totp.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication/totp.mdx
 ---
 
 ## Authenticate with a time-based one-time password
 
 Authenticates a user enrolled into MFA using time-based one-time password (TOTP).
 
-Users enrolled into MFA are required to enter a TOTP each time they sign in. When they attempt to authenticate with their credentials, the API will return an [MFA challenge error](/reference/user-management/authentication-errors/mfa-challenge-error) that contains a pending authentication token.
+Users enrolled into MFA are required to enter a TOTP each time they sign in. When they attempt to authenticate with their credentials, the API will return an [MFA challenge error](/reference/authkit/authentication-errors/mfa-challenge-error) that contains a pending authentication token.
 
-To continue with the authentication flow, [challenge](/reference/mfa/challenge-factor) one of the factors returned by the MFA challenge error response and present a UI to the user to enter the TOTP code. Then, authenticate the user with the TOTP code, the challenge from the factor, and the pending authentication token from the MFA challenge error.
+To continue with the authentication flow, [challenge](/reference/mfa/challenge/create) one of the factors returned by the MFA challenge error response and present a UI to the user to enter the TOTP code. Then, authenticate the user with the TOTP code, the challenge from the factor, and the pending authentication token from the MFA challenge error.
 
 MFA can be enabled via the [Authentication page](https://dashboard.workos.com/authentication) in the WorkOS dashboard.
 

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/email-verification-required-error.mdx

@@ -4,7 +4,7 @@ reference:
     - key: email_verification_required_error
       id: email_verification_required_error
       url: >-
-        /reference/user-management/authentication-errors/email-verification-required-error
+        /reference/authkit/authentication-errors/email-verification-required-error
       title: email_verification_required
       sendsEmail: true
       properties:
@@ -24,7 +24,7 @@ reference:
           type: string
           description: (email_verification.id)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/email-verification-required-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/email-verification-required-error.mdx
 ---
 
 ## Email verification required error
@@ -37,6 +37,6 @@ This error indicates that a user with an unverified email address attempted to a
   file="email-verification-required-error"
 />
 
-When this error occurs and the [email setting](/user-management/custom-emails) for email verification is enabled, WorkOS will automatically send a one-time email verification code to the user’s email address and issue a pending authentication token. If the email setting is not enabled, [retrieve the email verification code](/reference/user-management/email-verification/get) to send the email verification email yourself. To complete the authentication process, use the pending authentication token from the error and the one-time code the user received to [authenticate](/reference/user-management/authentication) them and to verify their email address.
+When this error occurs and the [email setting](/authkit/custom-emails) for email verification is enabled, WorkOS will automatically send a one-time email verification code to the user’s email address and issue a pending authentication token. If the email setting is not enabled, [retrieve the email verification code](/reference/authkit/email-verification/get) to send the email verification email yourself. To complete the authentication process, use the pending authentication token from the error and the one-time code the user received to [authenticate](/reference/authkit/authentication) them and to verify their email address.
 
 The same applies when a user attempts to authenticate with OAuth or SSO, but there was already an account with a matching unverified email address.

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/index.mdx

@@ -8,9 +8,7 @@ descriptions:
       corresponding method after this error occurs.
     email: The email of the authenticating user.
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/index.mdx
----
-
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/index.mdx
 ---
 
 # Authentication errors

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/mfa-challenge-error.mdx

@@ -7,7 +7,7 @@ reference:
   json:
     - key: mfa_challenge_error
       id: mfa_challenge_error
-      url: /reference/user-management/authentication-errors/mfa-challenge-error
+      url: /reference/authkit/authentication-errors/mfa-challenge-error
       title: mfa_challenge
       properties:
         - key: code
@@ -26,7 +26,7 @@ reference:
           type: user
           description: (user.self)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/mfa-challenge-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/mfa-challenge-error.mdx
 ---
 
 ## MFA challenge error
@@ -39,6 +39,6 @@ This error indicates that a user enrolled into MFA attempted to authenticate in
   file="mfa-challenge-error"
 />
 
-When this error occurs, you’ll need to present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/user-management/authentication/totp), the pending authentication token from this error, and a [challenge](/reference/mfa/challenge-factor) that corresponds to one of the authentication factors.
+When this error occurs, you’ll need to present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/authkit/authentication/totp), the pending authentication token from this error, and a [challenge](/reference/mfa/challenge/create) that corresponds to one of the authentication factors.
 
 MFA can be enabled via the [Authentication page](https://dashboard.workos.com/authentication) in the WorkOS dashboard.

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/mfa-enrollment-error.mdx

@@ -3,7 +3,7 @@ reference:
   json:
     - key: mfa_enrollment_error
       id: mfa_enrollment_error
-      url: /reference/user-management/authentication-errors/mfa-enrollment-error
+      url: /reference/authkit/authentication-errors/mfa-enrollment-error
       title: mfa_enrollment
       properties:
         - key: code
@@ -19,7 +19,7 @@ reference:
           type: user
           description: (user.self)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/mfa-enrollment-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/mfa-enrollment-error.mdx
 ---
 
 ## MFA enrollment error
@@ -32,6 +32,6 @@ This error indicates that a user who is not enrolled into MFA attempted to authe
   file="mfa-enrollment-error"
 />
 
-When this error occurs, you’ll need to present an [MFA enrollment](/reference/user-management/mfa/enroll-auth-factor) UI to the user. Once the user has enrolled, present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/user-management/authentication/totp) and the pending authentication token from this error.
+When this error occurs, you’ll need to present an [MFA enrollment](/reference/authkit/mfa/enroll-auth-factor) UI to the user. Once the user has enrolled, present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/authkit/authentication/totp) and the pending authentication token from this error.
 
 MFA can be enabled via the [Authentication page](https://dashboard.workos.com/authentication) in the WorkOS dashboard.

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/organization-authentication-required-error.mdx

@@ -15,7 +15,7 @@ reference:
     - key: organization_authentication_required_error
       id: organization_authentication_required_error
       url: >-
-        /reference/user-management/authentication-errors/organization-authentication-required-error
+        /reference/authkit/authentication-errors/organization-authentication-required-error
       title: organization_authentication_methods_required
       properties:
         - key: error
@@ -52,12 +52,12 @@ reference:
               type: boolean
               description: (authentication_errors.password)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/organization-authentication-required-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/organization-authentication-required-error.mdx
 ---
 
 ## Organization authentication required error
 
-This error indicates that a user attempted to authenticate with an authentication method that is not allowed by the organization that has a [domain policy](/user-management/organization-policies) managing this user. It includes all the possible methods the user can use to authenticate.
+This error indicates that a user attempted to authenticate with an authentication method that is not allowed by the organization that has a [domain policy](/authkit/organization-policies) managing this user. It includes all the possible methods the user can use to authenticate.
 
 <CodeBlock
   title="Organization authentication required error"

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/organization-selection-error.mdx

@@ -8,8 +8,7 @@ reference:
   json:
     - key: organization_selection_required_error
       id: organization_selection_required_error
-      url: >-
-        /reference/user-management/authentication-errors/organization-selection-error
+      url: /reference/authkit/authentication-errors/organization-selection-error
       title: organization_selection_required
       properties:
         - key: code
@@ -28,7 +27,7 @@ reference:
           type: array
           description: (authentication_errors.organizations)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/organization-selection-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/organization-selection-error.mdx
 ---
 
 ## Organization selection required error
@@ -41,4 +40,4 @@ This error indicates that the user is a member of multiple organizations and mus
   file="organization-selection-error"
 />
 
-When this error occurs, you’ll need to display the list of organizations that the user is a member of and authenticate them with the [selected organization](/reference/user-management/authentication/organization-selection) using the pending authentication token from the error.
+When this error occurs, you’ll need to display the list of organizations that the user is a member of and authenticate them with the [selected organization](/reference/authkit/authentication/organization-selection) using the pending authentication token from the error.

package/.docs/organized/docs/reference/{user-management → authkit}/authentication-errors/sso-required-error.mdx

@@ -15,7 +15,7 @@ reference:
   json:
     - key: sso_required_error
       id: sso_required_error
-      url: /reference/user-management/authentication-errors/sso-required-error
+      url: /reference/authkit/authentication-errors/sso-required-error
       title: sso_required
       properties:
         - key: error
@@ -35,7 +35,7 @@ reference:
           optional: true
           description: (authentication_errors.optional_pending_authentication_token)
 originalPath: >-
-  .tmp-workos-clone/packages/docs/content/reference/user-management/authentication-errors/sso-required-error.mdx
+  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/sso-required-error.mdx
 ---
 
 ## SSO required error
@@ -48,4 +48,4 @@ This error indicates that a user attempted to authenticate into an organization
   file="sso-required-error"
 />
 
-When this error occurs, you’ll need to use one of the SSO connections from the error to [get the authorization URL](/reference/user-management/authentication/get-authorization-url) and redirect the user to that URL to complete the authentication with the organization’s identity provider.
+When this error occurs, you’ll need to use one of the SSO connections from the error to [get the authorization URL](/reference/authkit/authentication/get-authorization-url) and redirect the user to that URL to complete the authentication with the organization’s identity provider.

package/.docs/organized/docs/reference/authkit/cli-auth/device-authorization.mdx

@@ -0,0 +1,61 @@
+---
+title: Get a device authorization URL
+description: Initiate the CLI Auth flow by obtaining a device code and verification URLs.
+descriptions:
+  device_authorization:
+    client_id: The WorkOS client ID for your application.
+  device_authorization_response:
+    device_code: >-
+      A unique identifier for this authorization request. Use this when polling
+      the token endpoint.
+    user_code: 'A short, user-friendly code that users enter to authorize the device.'
+    verification_uri: The URL where users can enter the user code to authorize the device.
+    verification_uri_complete: 'A URL with the user code pre-filled, allowing one-click authorization.'
+    expires_in: >-
+      The lifetime of the device code and user code in seconds. The default is 5
+      minutes.
+    interval: >-
+      The minimum interval in seconds between token requests. The default is 5
+      seconds.
+reference:
+  curl:
+    - key: device-authorization
+      id: device_authorization_request
+      url: /reference/authkit/cli-auth/device-authorization
+      title: /user_management/authorize/device
+      type: POST
+      parameters:
+        - key: client_id
+          type: string
+          description: (device_authorization.client_id)
+      returns:
+        - key: device_code
+          type: string
+          description: (device_authorization_response.device_code)
+        - key: user_code
+          type: string
+          description: (device_authorization_response.user_code)
+        - key: verification_uri
+          type: string
+          description: (device_authorization_response.verification_uri)
+        - key: verification_uri_complete
+          type: string
+          description: (device_authorization_response.verification_uri_complete)
+        - key: expires_in
+          type: integer
+          description: (device_authorization_response.expires_in)
+        - key: interval
+          type: integer
+          description: (device_authorization_response.interval)
+originalPath: >-
+  .tmp-workos-clone/packages/docs/content/reference/authkit/cli-auth/device-authorization.mdx
+---
+
+## Get device authorization URL
+
+Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)) and is designed for command-line applications or other devices with limited input capabilities.
+
+<CodeBlock referenceId="device_authorization_request">
+  <CodeBlockTab title="Request" file="device-authorization-request" />
+  <CodeBlockTab title="Response" file="device-authorization-response" />
+</CodeBlock>

package/.docs/organized/docs/reference/authkit/cli-auth/device-code.mdx

@@ -0,0 +1,57 @@
+---
+title: Device code
+description: Exchange a device code for access and refresh tokens during the CLI Auth flow.
+descriptions:
+  device_code_request:
+    grant_type: >-
+      Must be `urn:ietf:params:oauth:grant-type:device_code` for device
+      authorization flow.
+    device_code: The device code obtained from the device authorization endpoint.
+    client_id: The WorkOS client ID for your application.
+  device_code_response:
+    access_token: The access token for making authenticated requests.
+    refresh_token: The refresh token for obtaining new access tokens.
+    token_type: 'The token type, always "Bearer".'
+    expires_in: The lifetime of the access token in seconds.
+reference:
+  curl:
+    - key: device-code
+      id: device_code_exchange
+      url: /reference/authkit/cli-auth/device-code
+      title: /user_management/authenticate
+      type: POST
+      parameters:
+        - key: grant_type
+          type: '"urn:ietf:params:oauth:grant-type:device_code"'
+          description: (device_code_request.grant_type)
+        - key: device_code
+          type: string
+          description: (device_code_request.device_code)
+        - key: client_id
+          type: string
+          description: (device_code_request.client_id)
+      returns:
+        - key: access_token
+          type: string
+          description: (device_code_response.access_token)
+        - key: refresh_token
+          type: string
+          description: (device_code_response.refresh_token)
+        - key: token_type
+          type: '"Bearer"'
+          description: (device_code_response.token_type)
+        - key: expires_in
+          type: integer
+          description: (device_code_response.expires_in)
+originalPath: >-
+  .tmp-workos-clone/packages/docs/content/reference/authkit/cli-auth/device-code.mdx
+---
+
+## Device code
+
+Exchanges a device code for access and refresh tokens as part of the [CLI Auth](/authkit/cli-auth) flow. This endpoint should be polled repeatedly until the user authorizes the request, declines it, or the device code expires.
+
+<CodeBlock referenceId="device_code_exchange">
+  <CodeBlockTab title="Request" file="device-code-request" />
+  <CodeBlockTab title="Response" file="device-code-response" />
+</CodeBlock>

package/.docs/organized/docs/reference/authkit/cli-auth/error-codes.mdx

@@ -0,0 +1,31 @@
+---
+originalPath: >-
+  .tmp-workos-clone/packages/docs/content/reference/authkit/cli-auth/error-codes.mdx
+---
+### Error codes
+
+When polling the device code endpoint, you may receive various error responses before the user completes authorization or if authorization fails. These errors help your application understand the current state and take appropriate action.
+
+Possible error codes and the corresponding descriptions are listed below.
+
+| Error code               | Description                                                                                                                                                           |
+| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `authorization_pending`  | The authorization request is still pending as the user hasn't yet completed the user interaction flow. Continue polling at the specified interval.                    |
+| `slow_down`              | The client is polling too frequently and should slow down. Increase your polling interval by at least 5 seconds and continue polling.                                 |
+| `access_denied`          | The user declined the authorization request. Stop polling and inform the user that authorization was denied.                                                          |
+| `expired_token`          | The device code has expired (typically after 5 minutes). Stop polling and restart the authorization flow if needed.                                                   |
+| `invalid_request`        | The request is missing a required parameter or includes an invalid parameter value. Check that `grant_type`, `device_code`, and `client_id` are provided and correct. |
+| `invalid_client`         | Client authentication failed (e.g., unknown client, client authentication not included, or unsupported authentication method).                                        |
+| `invalid_grant`          | The provided device code is invalid, malformed, or has already been used.                                                                                             |
+| `unsupported_grant_type` | The grant type is not supported. Ensure you're using `urn:ietf:params:oauth:grant-type:device_code`.                                                                  |
+
+### Error response format
+
+All error responses are returned with a 400 status code and follow the OAuth 2.0 error response format. For example:
+
+```json
+{
+  "error": "authorization_pending",
+  "error_description": "The authorization request is still pending as the user hasn't yet completed the user interaction flow."
+}
+```

package/.docs/organized/docs/reference/authkit/cli-auth/index.mdx

@@ -0,0 +1,22 @@
+---
+descriptions:
+  cli_auth:
+    device_code: >-
+      A unique identifier for the authorization request used when polling the
+      token endpoint.
+    user_code: 'A short, user-friendly code that users enter to authorize the device.'
+    verification_uri: The URL where users can enter the user code to authorize the device.
+    verification_uri_complete: A URL with the user code pre-filled for one-click authorization.
+originalPath: .tmp-workos-clone/packages/docs/content/reference/authkit/cli-auth/index.mdx
+---
+
+# CLI Auth
+
+CLI Auth enables command-line applications to authenticate users through the web using the [OAuth 2.0 Device Authorization Flow](https://datatracker.ietf.org/doc/html/rfc8628).
+
+The CLI Auth flow involves two main endpoints:
+
+1. The **device authorization URL** initiates the flow by obtaining a device code, user code, and verification URIs.
+2. The **device access token URL** is where the device exchanges the device code for access and refresh tokens after the user authenticates.
+
+Read more about [CLI Auth here](/authkit/cli-auth).