OAuth 2.0 Device Authorization Flow
Flow for input-constrained devices, such as smart TVs and consoles, that displays a short code the user enters on a secondary device to authenticate and approve access, while the device polls the authorization server for an access token.
The device authorization grant is designed for devices that have a browser-less or input-constrained interface, such as smart TVs, game consoles, printers or IoT devices. Typing credentials with a remote control is awkward, so the device delegates authentication to a secondary device, such as a smartphone or laptop, that has a full browser and keyboard.
The device obtains a short user code and a verification URI from the authorization server and shows them to the user. While the user authenticates and approves access on the secondary device, the device repeatedly polls the token endpoint until the authorization server issues an access token. The user never enters credentials on the device itself.