Skip to content

Commit 87c75d1

Browse files
unatasha8vinckr
authored andcommitted
chore: Revise Device Authorization Grant documentation
Updated the description and steps for the Device Authorization Grant to clarify the process and correct terminology.
1 parent 329b282 commit 87c75d1

File tree

1 file changed

+33
-32
lines changed

1 file changed

+33
-32
lines changed

docs/oauth2-oidc/device-authorization.mdx

Lines changed: 33 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,68 +4,69 @@ title: Device Authorization
44
sidebar_label: Device authorization flow
55
---
66

7-
The OAuth 2.0 Device Authorization Grant -also known as Device Flow- is OAuth 2.0 extension that enables devices with no browser
8-
or limited input capability to obtain an access token. It enables users to authotize devices with limited input capabilities, such
9-
as smart TVs, gaming consoles, or IoT devices, by delegating the authentication process to another device with a full browser such
10-
as a phone or computer.
7+
The OAuth 2.0 Device Authorization Grant (RFC 8628) brings OAuth to devices with internet connectivity but limited input
8+
capabilities. This flow is designed for smart TVs, streaming devices, IoT hardware, printers, AI agents and other connected devices
9+
where typing credentials isn't practical. Here's how it works: the device to be authenticated displays a URL and a short code, prompting
10+
you to open that URL on your phone or computer to authorize access. The two devices don't need to communicate directly—the authorization
11+
happens through the OAuth provider.
1112

12-
This document provides an overview of the Device Authorization Grant, a step-by-step example of its implementation, configuration
13+
This document provides an overview of the Ory's device authorization grant flow, with a step-by-step example of its implementation, configuration
1314
options, and guidance on creating custom user interfaces for the verification screen.
1415

1516
## Overview of the flow
1617

17-
Here is the high-level overview for the Device Authorization Flow:
18+
Here is the high-level overview for the device authorization grant flow:
1819

19-
1. The device requests to be authorized from the Authorization Server.
20-
1. The user is instructed to visit a URL on a different device and is given a user code.
21-
1. On a different device the user visits the URL, provides the user code, logs in and grants access to the device.
22-
1. The device polls the Authorization Server. Once the user authenticates and grants access, an access token is returned that can
23-
be used to access the protected resource.
20+
1. The user attempts to log in to the device. This initiates the device to request authorization from the authorization server.
21+
1. When the authorization server responds, the user is instructed to visit a URL and enter the provided user code, which they do
22+
on a different device.
23+
1. On the different device the user visits the URL, enters the user code, (logs in, if needed) and grants access to the device.
24+
1. In the meantime, the device polls the authorization server. Once the user authenticates and grants access, the authenicaton server
25+
sends an access token to the device, which is used to access the protected resource.
2426

2527
### Device requests authorization
2628

27-
The user tries to log in through the limited input device. The device sends a POST request to the Authorization Server to initiate
29+
The user attempts to log in through the limited input device. The device sends a POST request to the authorization server to initiate
2830
the flow with the following parameters:
2931

30-
- `client_id`: The ID of the client that's making the request.
31-
- `scope` (optional): The scope of the access request, which specifies what resources the requesting application can access.
32+
- `client_id`: The ID of the client (device) that's making the request.
33+
- `scope` (optional): The scope of the access request, which specifies which resources the requesting device can access.
3234

33-
The Authorization Server responds with the following information:
35+
The authorization server responds with the following information:
3436

35-
- `device_code`: A unique code to identify the authorization request.
36-
- `user_code`: A code the user will enter at the verification URL.
37-
- `verification_uri`: The URL where the user can authorize the device.
38-
- `verification_uri_complete`: The URL where the user can authorize the device, with the user_code already filled in.
39-
- `expires_in`: The lifespan of the device code (in seconds).
40-
- `interval`: The polling interval (in seconds) for the client to check if the user has authorized the device.
37+
- `device_code`: A unique code to identify the authorization request
38+
- `user_code`: A code the user enters at the verification URL
39+
- `verification_uri`: The URL where the user authorizes the device
40+
- `verification_uri_complete`: The URL where the user authorizes the device, with the user_code already filled in
41+
- `expires_in`: The lifespan of the device code (in seconds)
42+
- `interval`: The polling interval (in seconds) for the client to check if the user has authorized the device yet
4143

4244
### Display user code and verification URI
4345

44-
The device shows the user the `user_code` and `verification_uri` it received from the Authorization Server.
45-
46-
The user visits the provided URI on a separate device, such as a phone, and enters the code.
46+
The device shows the user the `user_code` and `verification_uri` it received from the authorization server.
4747

4848
### User grants permission
4949

50-
Once the user enters the code, they're prompted to log in, if not already authenticated, and grant or deny permission to the
51-
client. After granting permission, the user is redirected to a page confirming successful login.
50+
The user visits the provided URI on a separate device, such as a phone, and enters the code. Once the user enters the code,
51+
the user is prompted to log in, if not already authenticated, and grants or denies permission to the client (device). After granting
52+
permission, the user is redirected to a page confirming they are successfully logged in.
5253

5354
### Device polls for the access token
5455

55-
While the user is authorizing the device, the device polls the `token` endpoint of the Authorization Server to check whether the
56+
While the user is authorizing the device, the device polls the `token` endpoint of the authorization server to check whether the
5657
user has completed the authorization process, by making a POST request with the following parameters:
5758

58-
- `client_id`: The ID of the client that's making the request.
59-
- `device_code`: The device code received from the device authorization request.
60-
- `grant_type`: This should always be `urn:ietf:params:oauth:grant-type:device_code`.
59+
- `client_id`: The ID of the client that's making the request
60+
- `device_code`: The device code returned from the authorization request
61+
- `grant_type`: This must always be `urn:ietf:params:oauth:grant-type:device_code`
6162

62-
After the user grants permission, the Authorization Server will respond with an access token.
63+
After the user grants permission, the authenicaton server sends an access token to the device, which is used to access the protected resource.
6364

6465
## Configuration options
6566

6667
### Configuring the user interface
6768

68-
To enable and configure the Device Authorization Grant in Ory Hydra, adjust the following settings in your configuration file:
69+
To enable and configure the device authorization grant in Ory Hydra, adjust the following settings in your configuration file:
6970

7071
```
7172
urls:

0 commit comments

Comments
 (0)