1. Request a Device Code

In order to initiate the Device Authorization Grant, we need to request a device code from the authorization server. The request is sent to the following URL:

With body data:

We have obtained a device code

Let's break down what we have received...

• device_code

  This is a long-lived code that the client (your device or app) will use to poll the authorization server to find out if the user completed the authorization step. This code is typically longer and not user-friendly, as it's not meant to be entered by a human but used programmatically.

• user_code

  This is a short-lived, user-friendly code that the end-user will enter on another device or computer with better input capabilities to authorize the device. The life of this code is typically shorter than the device_code because it's expected that users will enter it relatively quickly after it's generated.

• verification_uri

  This is the URL where the user should go (on a browser on another device or computer) to enter the user_code and approve or deny the authorization request. After navigating to this URL, the user will typically be asked to login (if not already) and then prompted to enter the user_code.

• interval

  This is the recommended interval (in seconds) at which the client should poll the authorization server to check if the user has completed the authorization step. For example, with an interval of 10, the client should wait for 10 seconds between each poll to the server. This helps in preventing too frequent requests which could overload the server.

• expires_in

  This is the duration (in seconds) for which the device_code and user_code remain valid. After this time, both codes will expire and the device will need to start the authorization process again if the user has not yet completed the authorization step.

Now we have everything to instruct user what to do...