🍜ProtocolSoup

Device Authorization Grant

RFC 8628 grant for input-constrained devices (TVs, CLI tools, consoles). The device displays a user_code; the person authorizes on a second device with a browser. Still the correct grant for that constraint; native apps with a browser should use authorization code + PKCE (RFC 8252).

Try in Looking Glass

Sequence Diagram

Click any step for details

Auth Server1Device Authorization Request2Device Authorization Response3User Interaction4Device Access Token Request
Request
Response
Redirect
Internal

Step-by-Step Breakdown

1
Device Authorization Request
Device Client → Authorization Server
2
Device Authorization Response
Authorization Server → Device Client
3
User Interaction
End User → Authorization Server
4
Device Access Token Request
Device Client → Authorization Server

Token Inspector

Specs for this flow

Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.
BackLooking Glass