@@ -4,68 +4,69 @@ title: Device Authorization
44sidebar_label : Device authorization flow
55---
66
7- The OAuth 2.0 Device Authorization Grant -also known as Device Flow- is OAuth 2.0 extension that enables devices with no browser
8- or limited input capability to obtain an access token. It enables users to authotize devices with limited input capabilities, such
9- as smart TVs, gaming consoles, or IoT devices, by delegating the authentication process to another device with a full browser such
10- as a phone or computer.
7+ The OAuth 2.0 Device Authorization Grant (RFC 8628) brings OAuth to devices with internet connectivity but limited input
8+ capabilities. This flow is designed for smart TVs, streaming devices, IoT hardware, printers, AI agents and other connected devices
9+ where typing credentials isn't practical. Here's how it works: the device to be authenticated displays a URL and a short code, prompting
10+ you to open that URL on your phone or computer to authorize access. The two devices don't need to communicate directly—the authorization
11+ happens through the OAuth provider.
1112
12- This document provides an overview of the Device Authorization Grant, a step-by-step example of its implementation, configuration
13+ This document provides an overview of the Ory's device authorization grant flow, with a step-by-step example of its implementation, configuration
1314options, and guidance on creating custom user interfaces for the verification screen.
1415
1516## Overview of the flow
1617
17- Here is the high-level overview for the Device Authorization Flow :
18+ Here is the high-level overview for the device authorization grant flow :
1819
19- 1 . The device requests to be authorized from the Authorization Server.
20- 1 . The user is instructed to visit a URL on a different device and is given a user code.
21- 1 . On a different device the user visits the URL, provides the user code, logs in and grants access to the device.
22- 1 . The device polls the Authorization Server. Once the user authenticates and grants access, an access token is returned that can
23- be used to access the protected resource.
20+ 1 . The user attempts to log in to the device. This initiates the device to request authorization from the authorization server.
21+ 1 . When the authorization server responds, the user is instructed to visit a URL and enter the provided user code, which they do
22+ on a different device.
23+ 1 . On the different device the user visits the URL, enters the user code, (logs in, if needed) and grants access to the device.
24+ 1 . In the meantime, the device polls the authorization server. Once the user authenticates and grants access, the authenicaton server
25+ sends an access token to the device, which is used to access the protected resource.
2426
2527### Device requests authorization
2628
27- The user tries to log in through the limited input device. The device sends a POST request to the Authorization Server to initiate
29+ The user attempts to log in through the limited input device. The device sends a POST request to the authorization server to initiate
2830the flow with the following parameters:
2931
30- - ` client_id ` : The ID of the client that's making the request.
31- - ` scope ` (optional): The scope of the access request, which specifies what resources the requesting application can access.
32+ - ` client_id ` : The ID of the client (device) that's making the request.
33+ - ` scope ` (optional): The scope of the access request, which specifies which resources the requesting device can access.
3234
33- The Authorization Server responds with the following information:
35+ The authorization server responds with the following information:
3436
35- - ` device_code ` : A unique code to identify the authorization request.
36- - ` user_code ` : A code the user will enter at the verification URL.
37- - ` verification_uri ` : The URL where the user can authorize the device.
38- - ` verification_uri_complete ` : The URL where the user can authorize the device, with the user_code already filled in.
39- - ` expires_in ` : The lifespan of the device code (in seconds).
40- - ` interval ` : The polling interval (in seconds) for the client to check if the user has authorized the device.
37+ - ` device_code ` : A unique code to identify the authorization request
38+ - ` user_code ` : A code the user enters at the verification URL
39+ - ` verification_uri ` : The URL where the user authorizes the device
40+ - ` verification_uri_complete ` : The URL where the user authorizes the device, with the user_code already filled in
41+ - ` expires_in ` : The lifespan of the device code (in seconds)
42+ - ` interval ` : The polling interval (in seconds) for the client to check if the user has authorized the device yet
4143
4244### Display user code and verification URI
4345
44- The device shows the user the ` user_code ` and ` verification_uri ` it received from the Authorization Server.
45-
46- The user visits the provided URI on a separate device, such as a phone, and enters the code.
46+ The device shows the user the ` user_code ` and ` verification_uri ` it received from the authorization server.
4747
4848### User grants permission
4949
50- Once the user enters the code, they're prompted to log in, if not already authenticated, and grant or deny permission to the
51- client. After granting permission, the user is redirected to a page confirming successful login.
50+ The user visits the provided URI on a separate device, such as a phone, and enters the code. Once the user enters the code,
51+ the user is prompted to log in, if not already authenticated, and grants or denies permission to the client (device). After granting
52+ permission, the user is redirected to a page confirming they are successfully logged in.
5253
5354### Device polls for the access token
5455
55- While the user is authorizing the device, the device polls the ` token ` endpoint of the Authorization Server to check whether the
56+ While the user is authorizing the device, the device polls the ` token ` endpoint of the authorization server to check whether the
5657user has completed the authorization process, by making a POST request with the following parameters:
5758
58- - ` client_id ` : The ID of the client that's making the request.
59- - ` device_code ` : The device code received from the device authorization request.
60- - ` grant_type ` : This should always be ` urn:ietf:params:oauth:grant-type:device_code ` .
59+ - ` client_id ` : The ID of the client that's making the request
60+ - ` device_code ` : The device code returned from the authorization request
61+ - ` grant_type ` : This must always be ` urn:ietf:params:oauth:grant-type:device_code `
6162
62- After the user grants permission, the Authorization Server will respond with an access token.
63+ After the user grants permission, the authenicaton server sends an access token to the device, which is used to access the protected resource .
6364
6465## Configuration options
6566
6667### Configuring the user interface
6768
68- To enable and configure the Device Authorization Grant in Ory Hydra, adjust the following settings in your configuration file:
69+ To enable and configure the device authorization grant in Ory Hydra, adjust the following settings in your configuration file:
6970
7071```
7172urls:
0 commit comments