Intermediate LevelAuthentication & Authorization
What is the OAuth 2.0 Device Authorization Grant (Device Flow / RFC 8628)?
❓ Interview Prompt: Explain OAuth 2.0 Device Flow for Smart TVs, CLI tools, user_code display, verification URIs, and background polling.
The OAuth 2.0 Device Authorization Grant (RFC 8628) is designed for internet-connected devices that either lack a web browser or have restricted input capabilities (e.g. Smart TVs, GitHub CLI, Apple TV, gaming consoles).
Execution Steps:
1
Device Requests Code: Device calls Auth Server '/device/code'.
2
Device Displays Info: Server returns a 'user_code' (e.g. 'WDJB-9921'), a 'verification_uri' ('https://company.com/activate'), and a 'device_code'.
3
User Action: User visits the URL on their smartphone or laptop and enters the 8-character code.
4
Device Polling: Meanwhile, the device polls the token endpoint ('/token') in the background until the user completes browser authentication, at which point the server returns access tokens to the device!
Code Implementation Example
typescript
// CLI tool polling OAuth Device Flow token endpoint
async function pollForDeviceToken(deviceCode: string, intervalSeconds: number) {
while (true) {
await new Promise(r => setTimeout(r, intervalSeconds * 1000));
const res = await fetch('https://auth.company.com/oauth/token', {
method: 'POST',
body: new URLSearchParams({
grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
device_code: deviceCode,
client_id: process.env.CLI_CLIENT_ID!
})
});
const data = await res.json();
if (data.access_token) return data; // Success!
if (data.error !== 'authorization_pending') throw new Error(data.error);
}
}💡CLI application background polling during OAuth 2.0 Device Flow.
🎯 Interview Key Takeaway
Device Flow allows browserless devices (CLI tools, Smart TVs) to obtain tokens via secondary smartphone browser authorization.
#Device Flow#OAuth 2.0#RFC 8628#CLI#Intermediate
Back to all Authentication & Authorization Questions→