--- title: "pando login, step 2 (polled): the user and a new machine credential" description: "Poll every `interval` seconds. Until the person confirms, the answer is\n400 with `error.code` `authorization_pending` (keep polling) or\n`slow_down` (add 5 seconds to the interval). `access_denied`,\n`expired_token` and `invalid_grant` end the attempt. On success,\n`joined` lists the monorepos (`owner/name`) whose email invites were accepted, and\nthe CLI stores `credential.secret` in\n`~/.pando/credentials/` (mode 600).\n" --- > Documentation Index > Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt > Use this file to discover all available pages before exploring further. Path: Pando API › users `POST /v1/login/token` Poll every `interval` seconds. Until the person confirms, the answer is 400 with `error.code` `authorization_pending` (keep polling) or `slow_down` (add 5 seconds to the interval). `access_denied`, `expired_token` and `invalid_grant` end the attempt. On success, `joined` lists the monorepos (`owner/name`) whose email invites were accepted, and the CLI stores `credential.secret` in `~/.pando/credentials/` (mode 600). ## Request body _Required._ - `loginPoll.device_code` (string, required) - `loginPoll.credential_name` (string, required) — The machine name. - `loginPoll.kind` (string, optional) - one of `"machine"`, `"sandbox"`; default `"machine"` ## Example request ```json { "device_code": "string", "credential_name": "string", "kind": "machine" } ``` ## Code samples ### cURL ```curl curl --request POST \ --url https://app.gitpando.com/v1/login/token \ --header 'Content-Type: application/json' \ --data ' { "device_code": "string", "credential_name": "string", "kind": "machine" } ' ``` ### TypeScript ```typescript const url = 'https://app.gitpando.com/v1/login/token'; const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({device_code: 'string', credential_name: 'string', kind: 'machine'}) }; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err)); ``` ### Python ```python import requests url = "https://app.gitpando.com/v1/login/token" payload = { "device_code": "string", "credential_name": "string", "kind": "machine" } headers = {"Content-Type": "application/json"} response = requests.post(url, json=payload, headers=headers) print(response.text) ``` ## Responses ### 200 Signed in #### Example ```json { "user": { "login": "string", "name": "string", "email": "string", "picture_url": "string", "created_at": "2019-08-24T14:15:22Z" }, "credential": { "id": "string", "name": "string", "kind": "machine", "created_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "secret": "string" }, "joined": [ "string" ] } ``` - `loginPoll.response.200.user` (object, required) - `loginPoll.response.200.user.login` (string, required) - `loginPoll.response.200.user.name` (string | null, required) - `loginPoll.response.200.user.email` (string | null, required) - `loginPoll.response.200.user.picture_url` (string | null, required) — Their WorkOS profile picture (an https URL of at most 2,048 characters), stored at each sign-in, browser or `pando login`, and refreshed every time (a removed picture becomes null). Null when there is none or it is not https: the web draws one. Pando never fetches, proxies or caches it. - `loginPoll.response.200.user.created_at` (string, required) - format `date-time` - `loginPoll.response.200.credential` (object, required) - `loginPoll.response.200.credential.id` (string, required) - `loginPoll.response.200.credential.name` (string, required) - `loginPoll.response.200.credential.kind` (string, required) - one of `"machine"`, `"sandbox"`, `"bootstrap"`, `"browser"` - `loginPoll.response.200.credential.created_at` (string, required) - format `date-time` - `loginPoll.response.200.credential.secret` (string, required) — `pando_` and 40 hex characters. Shown once; Pando keeps only its SHA-256. - `loginPoll.response.200.credential.last_used_at` (string | null, optional) - format `date-time` - `loginPoll.response.200.credential.expires_at` (string | null, optional) — Browser sessions only: the end unless used before then (each use pushes it to 30 days). - format `date-time` - `loginPoll.response.200.joined` (array, required) ### 400 Not yet, or not at all: `error.code` is one of the codes above. #### Example ```json { "error": { "code": "string", "message": "string", "paths": [ "string" ], "checks": { "sha": "string", "state": "success", "required": [ "string" ], "checks_unknown": "string", "missing": [ "string" ], "statuses": [ { "sha": "string", "context": "string", "state": "pending", "target_url": "string", "description": "string", "creator": "string", "app": "string", "created_at": "2019-08-24T14:15:22Z" } ] } } } ``` - `loginPoll.response.400.error` (object, required) - `loginPoll.response.400.error.code` (string, required) - `loginPoll.response.400.error.message` (string, required) - `loginPoll.response.400.error.paths` (array, optional) - `loginPoll.response.400.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing. - `loginPoll.response.400.error.checks.sha` (string | null, required) - `loginPoll.response.400.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused). - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"` - `loginPoll.response.400.error.checks.required` (array | null, required) — Null while unknown. - `loginPoll.response.400.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise. - `loginPoll.response.400.error.checks.statuses` (array, required) — The latest status per context. - `loginPoll.response.400.error.checks.statuses.sha` (string, required) - `loginPoll.response.400.error.checks.statuses.context` (string, required) - `loginPoll.response.400.error.checks.statuses.state` (string, required) - one of `"pending"`, `"success"`, `"failure"`, `"error"` - `loginPoll.response.400.error.checks.statuses.created_at` (string, required) - format `date-time` - `loginPoll.response.400.error.checks.statuses.target_url` (string | null, optional) - `loginPoll.response.400.error.checks.statuses.description` (string | null, optional) - `loginPoll.response.400.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:` for a status posted with a status token or by a CI integration; `hook:` for a status token from a web hook with no app. - `loginPoll.response.400.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows. - `loginPoll.response.400.error.checks.missing` (array, optional) Source: https://docs.gitpando.com/api/users/loginPoll/index.md