- Shipped
- November 15, 2026 at 12:39 PM UTC
- Author
- Kamo
- Commit
- d29a816
**************** relays RFC 8628 to SecurityService (form + Authorization byte for byte, issuer headers, no-store, no CORS). [/o/{orgId}]/device: eight big letter cells over one real input (paste, auto-uppercase, auto-dash, vowels/digits refused with a shake and the letters codes use), a code from the link filled in but never sent by itself, Continue -> /api/oauth/device/lookup -> the ordinary org-branded sign-in / Continue as / consent at /?oauth_request=<id>; the consent shows 'Make Sure This Code Matches Your Device'; ?status=approved|denied result cards (drawn ring + sparks, reduced motion respected); a provider without the device grant shows a calm not-available card.