There are no items in your cart
Add More
Add More
| Item Details | Price | ||
|---|---|---|---|
The Device Authorization feature is an OAuth 2.0 grant type. It allows users to sign in to input-constrained devices, such as smart TVs, digital picture frames, and printers, and devices with no browser.
Sat Apr 20, 2024
The Device Authorization is one of the trending and widely used OAuth 2.0 grant type. It is used by devices such as Smart TVs, digital picture frames, printers or devices which do not inhibit browser capabilities. This grant type lets you use a secondary trusted device, such as laptop or mobile phone, to complete sign-in to apps.
Device authorization starts when you would like to authenticate to an application on a device like Smart TV, for example "Netflix". So when Netflix app is launched on this device it communicates with OAuth Provider and fetches an user verification code and activation url, like below -
You will then need to go to the requested activation url using secondary device like your mobile phone or laptop and input the user verification code as shown in the image.
Activation URL: netflix.com/tv8
User Verification Code: 2261-49*
Netflix on Smart TV now exchange this user verification code with OAuth provider and generate an access token and yay! you are authenticated.
Device Authorization Grant is available for Native applications in Okta. It is available under both Classic and Identity Engine.
curl --request POST
--url https://${yourOktaDomain}/oauth2/default/v1/device/authorize \
--header 'Accept: application/json' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=${clientId}' \
--data-urlencode 'scope=openid profile offline_access'{
"device_code": "4ebdb4de-1f8b-4497-be01-ddfaf83c4e9c",
"user_code": "MHXTFRPK",
"verification_uri": "https://{yourOktaDomain}/activate",
"verification_uri_complete": "https://{yourOktaDomain}/activate?user_code=MHXTFRPK",
"expires_in": 600,
"interval": 5
}curl --request POST \
--url https://${yourOktaDomain}/oauth2/default/v1/token \
--header 'Accept: application/json' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=${clientId}' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \
--data-urlencode 'device_code=${deviceCode}'
{
"token_type": "Bearer",
"expires_in": 3600,
"access_token": "eyJraWQ...JQuDJh8g",
"scope": "openid profile offline_access",
"refresh_token": "zcLdr1FBXwtI9ej98VVVwtjDd-SmaoL06qr_UcY2tNA",
"id_token": "eyJraWQ...WI6KR0aQ"
}
Sumit Kumar Tiwari
An Okta enthusiast and consultant with experience in implementing IAM solutions for businesses of all scale.
Launch your Graphy