oauth.net
Device Authorization Grant
The Device Authorization Grant lets input-constrained devices — TVs, CLIs, game consoles — get access tokens by having the user approve the request on a separate device like their phone.
When to use this
Use the Device Authorization Grant when your app runs on a device that has no browser or makes it difficult to enter a URL — smart TVs, streaming devices, IoT devices, CLIs, and command-line tools. The device displays a short code and URL; the user types the URL on their phone or computer, enters the code, and approves access.
The flow works without any redirect URI. The device polls the token endpoint using the device_code it received until the user completes authorization or the code expires. The grant type value is urn:ietf:params:oauth:grant-type:device_code.
More resources
- Device Flow Token Request (oauth.com)
- Device Code Grant on the OAuth 2.0 Playground (oauth.com)