Approve device access from another browser.
A device or command-line app without a usable browser can display a code. The user signs in and approves access on another device.
Why this lesson?
A command-line app runs on a computer without a usable browser. The user approves access from a phone or another computer.
Learning goal and prerequisites
Request device authorization
The client requests a device authorization grant. The provider returns a private device_code, a user_code for display, and a verification web address where the person can enter that code.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Some devices cannot open a normal browser or accept complex text input. A television, game console, or small terminal may still need a user to authorize access. The OAuth device authorization flow lets the device separate the user interaction from the device that needs the token.
The device asks the authorization server for a device code and a short user code. It shows the user a verification address and the code. The user opens that address on another device, signs in, reviews the request, and approves or denies it.
While the user is deciding, the original device polls the token endpoint at the allowed interval. The authorization server returns a token only after approval. The device code is temporary and should not itself be treated as a bearer access token for the protected resource.
This flow is useful when the device has limited input or browser capability. It also creates a phishing risk if a user is tricked into entering a code that belongs to someone else’s device. Clear transaction information, short code lifetimes, and careful user prompts help the user understand which device or request they are approving.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.