Skip to content
Authometry Dashboard

OAuth and OIDC

Device Authorization

Authorize a device on a second screen without placing user credentials on the device.

Request codes

Show the returned user_code and verification_uri, or present verification_uri_complete as a QR code. Codes expire after ten minutes.

curl -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "content-type: application/x-www-form-urlencoded" \
  -d "scope=openid profile" \
  https://authometry.ch3n.cc/oauth/device/authorization

Poll responsibly

Poll /oauth/token with the device grant and device_code. Wait at least the returned interval between requests. Continue on authorization_pending, slow down when instructed, and stop on approval, denial, or expiry.

grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=DEVICE_CODE

Protect the user

  • Display the application name and requested scopes before approval.
  • Never ask the user to enter their Authometry password on the device.
  • Discard the device code after success, denial, or expiry.