Client-Initiated Backchannel Authentication (CIBA) Flow
Decoupled flow in which a client identifies the user with a known identifier and asks the authorization server, over a direct backchannel request, to authenticate them out of band on a secondary device, such as a smartphone, before issuing tokens to the consumption device.
Client-Initiated Backchannel Authentication (CIBA) is a decoupled flow: the device where the user starts a transaction (the consumption device) is different from the device where the user authenticates and gives consent (the authentication device). The client never redirects the user's browser to the authorization server.
Instead, the client identifies the user with a known identifier, such as an email address or username, and sends a direct HTTP request to the authorization server. The authorization server then contacts the user's registered secondary device, for example with a push notification or SMS, and the user approves the request there. This suits scenarios such as call-center verification, point-of-sale payments, or approving a transaction that was started on a shared or untrusted device.
This diagram shows the poll mode, where the client polls the token endpoint until the user has responded. CIBA also defines ping and push modes, in which the authorization server notifies the client instead.