Mint a WebRTC token for this device
Authenticated with the device secret. The PBX identity is taken from the device record — a caller-supplied name is ignored, so a device cannot mint a token that rings as a colleague. Tokens are short-lived (about an hour); refresh on launch and on returning to the foreground.
Authorization
deviceAuth A per-device secret issued by POST /v1/devices/enroll, presented as
Authorization: Device <secret>.
A distinct scheme rather than another bearer flavour: the bearer namespace already carries workspace API keys and session JWTs, and a device secret authorises far less than either — it can mint a WebRTC token for its own identity and report presence, and nothing else.
In: header
Response Body
application/json
curl -X POST "https://example.com/v1/devices/token"{ "token": "string", "endpoint": "string", "protocol": "string", "clientName": "string", "turnServer": {}, "expiresIn": 3600}Exchange a connection code for a device credential POST
Unauthenticated by design: the connection code IS the credential, which is what lets the agent app have no sign-in screen at all. Returns a long-lived per-device secret, shown ONCE, which the device then presents to mint short-lived WebRTC tokens and to heartbeat presence. Every failure except a full line answers `devices.code_invalid` without saying why — distinguishing expired from unknown from already-used would turn this into an oracle for whether six digits ever existed.
Record where to wake this device PUT
Presence answers which endpoints are alive. This answers what presence cannot: how to reach one that is not running. A killed app stops heartbeating and correctly leaves the extension fan-out — there is no socket to receive a call — so reaching it needs an out-of-band push, and a push needs an address. Send a PushKit VoIP token on iOS or an FCM registration token on Android. **Call this on every launch**: these tokens rotate silently on reinstall, restore and app-data clear, and a client that registers once will stop ringing with nothing to indicate why. The token is stored as given, not hashed — it is an address handed to Apple or Google verbatim, not a secret we verify. It is never returned by any endpoint.