- Shipped
- November 15, 2026 at 12:08 PM UTC
- Author
- Kamo
- Commit
- b3191d1
POST **************** (client authenticated like the token endpoint; a public DEVICE app names itself) answers device_code + an 8-letter consonant user code (XXXX-XXXX), verification_uri <issuer>/device, 600 s, interval 5. POST **************** turns the typed code into an ordinary connected-app authorization request (org-branded sign-in, Continue as, consent with the code to compare, access policy) - 10 tries a minute per address, every miss the same 404 CODE_NOT_FOUND. Allow issues the code grant's own authorization code into the device record and lands on **************** Deny / a refusal tells the device access_denied. The token endpoint's device_code grant: authorization_pending, slow_down (interval +5 s, kept), access_denied, expired_token, and a single-use exchange of that code (member still active, id_token without nonce, refresh only with offline_access); a fault keeps the decision for the next poll. Only DEVICE apps or apps given the grant explicitly (grantTypes, BAD_GRANT_TYPE otherwise); DEVICE apps need no return address and are public unless a token auth method is chosen. Discovery announces device_authorization_endpoint + the grant. Audit OAUTH_DEVICE_APPROVED. Voice clients unchanged.