> ## Documentation Index > Fetch the complete documentation index at: https://api.simkl.org/llms.txt > Use this file to discover all available pages before exploring further. # Device authorization (V2) > Starts the RFC 8628 device flow for input-constrained devices -- TVs, consoles, set-top boxes, CLIs. Show the returned `user_code` to the user and send them to `verification_uri`, then poll `POST /oauth2/token` with the `device_code` and `grant_type=urn:ietf:params:oauth:grant-type:device_code`. The `user_code` is 8 characters, displayed as `XXXX-YYYY`. Entry is forgiving: it is case-insensitive, hyphens and spaces are optional, and the letters `I`, `L` and `O` are accepted in place of `1`, `1` and `0`. You do not need to validate the user's typing yourself. Requires a `client_id` registered for OAuth V2. An AUTH V1 app cannot use this endpoint and is rejected with `invalid_client`. Omitting `scope` grants `media:read` only. ### Body format Both `application/x-www-form-urlencoded` (the RFC 6749 section 3.2 default) and `application/json` are accepted. Every parameter must be a plain string. Sending an array or object for any parameter returns `400 invalid_request` naming the offending parameter. Every `/oauth2/*` response is sent with `Cache-Control: no-store` and `Pragma: no-cache`. Do not cache these responses, including the errors. ## OpenAPI ````yaml /openapi.json post /oauth2/device openapi: 3.1.0 info: title: Simkl API version: 1.0.0 description: >- The **Simkl API** lets you build apps that track Movies, TV Shows, and Anime — scrobble playback, sync watch history, and pull rich metadata. All requests use HTTPS and return JSON. The base URL is `https://api.simkl.com`. **Every request needs three URL parameters and a `User-Agent` header:** ``` /endpoint?client_id=YOUR_CLIENT_ID&app-name=my-app&app-version=1.0 ``` See [Headers and required parameters](/conventions/headers) for the full reference. Endpoints that read or modify a user's data also need an `Authorization: Bearer ` header — see [OAuth 2.0](/api-reference/oauth) or the [PIN flow](/api-reference/pin). > ⚠️ **About the auto-rendered cURL examples on each endpoint page:** they omit `?client_id=…&app-name=…&app-version=…` from the URL for brevity. **You must add them yourself when copy-pasting**, or use the interactive **"Try it"** playground (it fills them in for you). This is a Mintlify rendering convention — every Mintlify-built API doc behaves the same way. **Get started** - [Quickstart](/quickstart) — first request in 60 seconds - [API rules](/api-rules) — what's allowed, what isn't - [Standard media objects](/conventions/standard-media-objects) — the shapes every endpoint speaks - [Errors](/conventions/errors) — every status code Simkl returns contact: name: Simkl Developer Support url: https://support.simkl.com termsOfService: https://simkl.com/about/policies/terms/ license: name: Simkl API Terms of Use url: https://simkl.com/about/policies/terms/ x-logo: url: https://i.simkl.com/img_tv/apiary_logo_api.png backgroundColor: '#0E5DAB' altText: Simkl servers: - url: https://api.simkl.com description: Production API - url: https://data.simkl.in description: CDN for static, public data files (Calendar + Trending). No auth required. security: - clientId: [] - simklApiKey: [] tags: - name: OAuth V2 description: >- Standards-compliant OAuth 2.0 with PKCE, scopes and refresh tokens. The recommended way to authenticate new apps. - name: OAuth 2.0 description: >- OAuth 2.0 authorization-code flow for web and mobile apps. The user is redirected to Simkl, signs in, approves your app, and is redirected back with a `code` you exchange for an `access_token`. Long-lived tokens — no refresh-token flow needed. externalDocs: description: OAuth 2.0 walkthrough url: https://api.simkl.org/api-reference/oauth - name: PIN description: >- Device flow for TVs, consoles, smart watches, CLI tools — anywhere typing a URL is hard. Show a 5-character code; user enters it on simkl.com/pin; you poll for the access token. **No `client_secret` required.** externalDocs: description: PIN flow walkthrough url: https://api.simkl.org/api-reference/pin - name: Redirect description: >- Helper redirects for one-click "mark as watched", trailers, sharing, and more. - name: Search description: Find shows, movies, and anime by ID, text query, file name, or randomly. externalDocs: description: Search guide url: https://api.simkl.org/guides/search - name: Movies description: >- Browse the Simkl movies catalog: details, premieres, top-of-best, and genre filters. - name: TV description: >- Browse the Simkl TV catalog: details, episodes, what's airing, premieres, top-of-best, and genre filters. - name: Anime description: >- Browse the Simkl anime catalog: details, episodes, what's airing, premieres, top-of-best, and genre filters. - name: Ratings description: >- Read Simkl's average community rating, rank, drop rate, and external ratings (IMDB, MAL) for any item, or for every item in a user's lists. - name: Scrobble description: >- Report real-time playback to Simkl with `start`, `pause`, and `stop`. At ≥ 80 % progress Simkl marks the item as watched automatically; below 80 % the session is saved as a paused playback the user can resume from any device. See [Standard media objects](/conventions/standard-media-objects) for the supported ID keys. ### Supported ID keys Inside any `ids` object, pass as many of these as you have. Simkl resolves to the canonical record. | ID key | Type | Example | |---|---|---| | `simkl` | integer | `49108`. Simkl's canonical ID. Most reliable. | | `imdb` | string | `tt1520211` | | `tmdb` | integer | `76757` (for TV, specify `type`) | | `tvdb` | int / string | `153021` or `the-walking-dead` | | `mal` | integer | `4246` (MyAnimeList) | | `anidb` | integer | `10846`. Specifying just this is enough for anime lookups. | | `anilist` | integer | `21` | | `kitsu` | integer | `12` | | `anisearch` | integer | `2227` | | `animeplanet` | string | `one-piece` | | `livechart` | integer | `321` | | `letterboxd` | string | `the-truman-show` | | `netflix` | integer | `70210890` (movie ID) | | `traktslug` | string | `john-wick-chapter-4-2023` | > 📖 Full reference: [Standard media objects](/conventions/standard-media-objects) externalDocs: description: Scrobble guide url: https://api.simkl.org/guides/scrobble - name: Sync description: >- Use Simkl as a cloud backup for the user's watch history and lists (Watching, Plan to Watch, On Hold, Dropped, Completed). **Always check [`/sync/activities`](/api-reference/simkl/get-activities) first** and sync only the lists that have moved. All write endpoints accept arrays — batch aggressively. See [Standard media objects](/conventions/standard-media-objects) for the supported ID keys. ### Supported ID keys Inside any `ids` object, pass as many of these as you have. Simkl resolves to the canonical record. | ID key | Type | Example | |---|---|---| | `simkl` | integer | `49108`. Simkl's canonical ID. Most reliable. | | `imdb` | string | `tt1520211` | | `tmdb` | integer | `76757` (for TV, specify `type`) | | `tvdb` | int / string | `153021` or `the-walking-dead` | | `mal` | integer | `4246` (MyAnimeList) | | `anidb` | integer | `10846`. Specifying just this is enough for anime lookups. | | `anilist` | integer | `21` | | `kitsu` | integer | `12` | | `anisearch` | integer | `2227` | | `animeplanet` | string | `one-piece` | | `livechart` | integer | `321` | | `letterboxd` | string | `the-truman-show` | | `netflix` | integer | `70210890` (movie ID) | | `traktslug` | string | `john-wick-chapter-4-2023` | > 📖 Full reference: [Standard media objects](/conventions/standard-media-objects) externalDocs: description: Sync guide url: https://api.simkl.org/guides/sync - name: Users description: User profile, settings, and watch statistics. - name: Lists description: >- Custom lists, read-only and in beta. Requires a Simkl PRO or VIP access token. externalDocs: description: Simkl API documentation url: https://api.simkl.org paths: /oauth2/device: post: tags: - OAuth V2 summary: Device authorization (V2) description: >- Starts the RFC 8628 device flow for input-constrained devices -- TVs, consoles, set-top boxes, CLIs. Show the returned `user_code` to the user and send them to `verification_uri`, then poll `POST /oauth2/token` with the `device_code` and `grant_type=urn:ietf:params:oauth:grant-type:device_code`. The `user_code` is 8 characters, displayed as `XXXX-YYYY`. Entry is forgiving: it is case-insensitive, hyphens and spaces are optional, and the letters `I`, `L` and `O` are accepted in place of `1`, `1` and `0`. You do not need to validate the user's typing yourself. Requires a `client_id` registered for OAuth V2. An AUTH V1 app cannot use this endpoint and is rejected with `invalid_client`. Omitting `scope` grants `media:read` only. ### Body format Both `application/x-www-form-urlencoded` (the RFC 6749 section 3.2 default) and `application/json` are accepted. Every parameter must be a plain string. Sending an array or object for any parameter returns `400 invalid_request` naming the offending parameter. Every `/oauth2/*` response is sent with `Cache-Control: no-store` and `Pragma: no-cache`. Do not cache these responses, including the errors. operationId: post-oauth2-device requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - client_id properties: client_id: type: string description: Your app's client ID. scope: type: string enum: - media:read - media:read media:write description: Defaults to `media:read` when omitted. example: client_id: YOUR_CLIENT_ID scope: media:read media:write responses: '200': description: Device authorization started. content: application/json: schema: $ref: '#/components/schemas/OAuth2DeviceResponse' example: device_code: >- EXAMPLEDEVICECODE00000000000000000000000000000000000000000000000 user_code: BDWP-HQPK verification_uri: https://simkl.com/pin verification_uri_complete: https://simkl.com/pin?user_code=BDWP-HQPK expires_in: 900 interval: 5 '401': description: Unknown client ID, or an app that is not registered for OAuth V2. content: application/json: schema: $ref: '#/components/schemas/OAuth2Error' example: error: invalid_client error_description: This client_id is not enabled for OAuth 2.0 security: - {} components: schemas: OAuth2DeviceResponse: type: object description: RFC 8628 section 3.2 device authorization response. required: - device_code - user_code - verification_uri - verification_uri_complete - expires_in - interval properties: device_code: type: string description: Secret handle the device polls with. Never show this to the user. user_code: type: string description: >- The 8-character code the user types, formatted `XXXX-YYYY`. Display it exactly as returned. examples: - BDWP-HQPK verification_uri: type: string description: Where the user goes to enter the code. examples: - https://simkl.com/pin verification_uri_complete: type: string description: >- The same page with the code pre-filled. Ideal for a QR code, since the user then types nothing. examples: - https://simkl.com/pin?user_code=BDWP-HQPK expires_in: type: integer description: Seconds until the device code expires. 900, i.e. 15 minutes. examples: - 900 interval: type: integer description: Minimum seconds between polls. 5. examples: - 5 OAuth2Error: type: object description: >- RFC 6749 section 5.2 error envelope. `error` is a fixed machine-readable code; `error_description` is human-readable and may change, so branch on `error` only. required: - error properties: error: type: string description: Machine-readable error code. enum: - invalid_request - invalid_client - invalid_grant - invalid_scope - unsupported_grant_type - expired_token - authorization_pending - slow_down - server_error error_description: type: string description: >- Human-readable explanation. For display and logging, not for branching. securitySchemes: clientId: type: apiKey in: query name: client_id description: >- Preferred form: your `client_id` as a URL query parameter on every request. Self-describing in logs and curl commands. See [Headers and required parameters](/conventions/headers). x-default: YOUR_CLIENT_ID simklApiKey: type: apiKey in: header name: simkl-api-key description: >- Optional alias for the `client_id` query parameter. Simkl accepts your `client_id` either as the `simkl-api-key` request header **or** as the `?client_id=…` query parameter — pick one. The query-parameter form is preferred because it makes the request fully self-describing in URL form. x-default: YOUR_CLIENT_ID ````