Skip to content
InternetData

Device authorization

post/oauth/device_authorization

Starts the device flow. Show the user_code to the person and send them to verification_uri; verification_uri_complete has the code already embedded, which is what to open if you can open a browser at all.

Then poll /oauth/token, no faster than interval seconds.

Request body

application/x-www-form-urlencoded

client_idrequiredstring
scopestring

Space-delimited. Anything your client is not registered for is dropped rather than refused.

resourcestring

RFC 8707: what the token is for.

Responses

200application/json

A pending device authorization.

device_coderequiredstring

Yours. Poll with it; never show it to anyone.

user_coderequiredstring

Short and typable. This is what the person confirms.

verification_urirequiredstring
verification_uri_completestring

The same page with the code already filled in.

expires_inrequiredinteger

Seconds until both codes expire.

intervalrequiredinteger

Seconds between polls.

TypeScript type
ts
{
  device_code: string;
  user_code: string;
  verification_uri: string;
  verification_uri_complete?: string;
  expires_in: number;
  interval: number;
}
400application/json

invalid_request, unauthorized_client when the client may not use the device flow, or slow_down when this address has started too many authorizations.

errorrequiredstring
error_descriptionstring
TypeScript type
ts
{
  error: string;
  error_description?: string;
}
401application/json

invalid_client: the client_id is not registered.

errorrequiredstring
error_descriptionstring
TypeScript type
ts
{
  error: string;
  error_description?: string;
}