Device Authorization Grant
RFC 8628 grant for input-constrained devices (TVs, CLI tools, consoles). The device displays a user_code; the person authorizes on a second device with a browser. Still the correct grant for that constraint; native apps with a browser should use authorization code + PKCE (RFC 8252).
Sequence Diagram
Click any step for details
Request
Response
Redirect
Internal
Step-by-Step Breakdown
1
Device Authorization Request
Device Client → Authorization Server
2
Device Authorization Response
Authorization Server → Device Client
3
User Interaction
End User → Authorization Server
4
Device Access Token Request
Device Client → Authorization Server
Token Inspector
Specs for this flow
Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.