Device Authorization Grant
RFC 8628 — OAuth 2.0 Device Authorization Grant for Input-Constrained Devices
Configuration
Device Authorization Request
The device requests a device code and user code from the authorization server. The user code and verification URI will be displayed to the user.
/oauth2/v1/device/authorize
Configuration
cURL Command
Response
User Authorization
The user visits the verification URI on a secondary device (phone, computer) and enters the user code to authorize the device. Application will present the user with code, URL, or generate QR to help guide use to the verification URI. The intent is to provide the least amount of friction on the user authenticating, in event the URL cannot be clicked or QR presenting you may create a short code URI and forward to the /activate.
Poll for Token
The device polls the token endpoint at the specified interval until the user completes authorization or the code expires.
/oauth2/v1/token
grant_type=urn:ietf:params:oauth:grant-type:device_code
cURL Command
Responses
Test Token with API
Test the access token by making an authenticated API request to a resource server.