OAuth and OIDC

Device Authorization

Authorize a device on a second screen without placing user credentials on the device.

Request codes

Show the returned user_code and verification_uri, or present verification_uri_complete as a QR code. Codes expire after ten minutes.

Example

curl -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "content-type: application/x-www-form-urlencoded" \
  -d "scope=openid profile" \
  https://authometry.jiayangchen.com/oauth/device/authorization

Poll responsibly

Poll /oauth/token with the device grant and device_code. Wait at least the returned interval between requests. Continue on authorization_pending, slow down when instructed, and stop on approval, denial, or expiry.

Example

grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=DEVICE_CODE

Protect the user

Display the application name and requested scopes before approval.
Never ask the user to enter their Authometry password on the device.
Discard the device code after success, denial, or expiry.