PRIVATExeonr.auth.private.v1.AutomationService
AutomationService is the surface an application automation key can call. Every method here carries allow_automation_keys and accepts NOTHING else: a portal session, an OAuth access token or a service account token is refused, and a key is refused on every method that does not carry the option. The caller acts as the key's bound user, for the clients of the key's application, and nothing more — the same authorization core the consent screen and the MCP tools use decides what is actually granted. Core only. Edge replicas serve a read-only snapshot and do not mount this service; point automation at the core hostname.
postApprove Device Code
Approves or denies a pending device authorization request from its user code, on behalf of the key's bound user.
postAuthorize
Completes an OAuth authorization request on behalf of the key's bound user and returns the redirect URL, authorization code and state.
postGet Automation Key Info
Returns the application, covered clients, bound user and limits of the automation key presented as the bearer token.
postMint Token
Issues an access token, and optionally an ID token and refresh token, for the key's bound user against one of the application's clients. Scopes are filtered exactly as consent would filter them.
Verify MFA Challenge POST
Completes a login held by org-account 2FA: validates the TOTP or recovery code against the challenge token from HandleLogin and returns the portal token. **Authentication:** None required (challenge token required)
Approve Device Code POST
Approves or denies a pending device authorization request from its user code, on behalf of the key's bound user.