OAuth2 Device Authorization

POST /auth/device-authorization

This API is used by your device to obtain authorization from the resource owner via a device code or QR code that your device can scan.

See the OAuth device authorization docs for more.

Uses the existing managed-client device flow. This endpoint is public, but validates its client and supported device grant; anonymous DCR clients support authorization_code and optional refresh_token, and cannot start the device flow.

Required scope

Not required

Request body

Fields

client_idstringRequired: The OAuth client identifier
scopestring: Space-separated list of scopes requested by the client

Returns

200

Device authorization initiated successfully

Fields

device_codestringRequired: The device verification code used to poll the token endpoint
user_codestringRequired: The user verification code displayed to the user
verification_uristringRequired: The URI where the user should enter the user code
verification_uri_completestring: The complete URI including the user code (optional, for convenience)
expires_inintegerRequired: The lifetime in seconds of the device_code and user_code
intervalintegerRequired: The minimum amount of time in seconds that the client should wait between polling requests

Errors

400

Invalid request parameters

Check the request fields and any validation details, then correct the payload.

500

Internal server error

Retry with backoff only when the operation is safe to repeat. Include the error code when reporting persistent failures.