Log in without a keyboard.

1. TV
2. IdP
3. Phone

1. POST /device_authorization

   Step 1 of 5

   The TV asks for a code

   In plain words The TV takes a numbered ticket, like at the deli counter.

   The device identifies itself with its client_id and the scopes it needs. It cannot open a browser, so it starts a different flow.

   POST https://idp.example.com/device_authorization
     client_id=tv-app
     &scope=openid profile offline_access

2. user_code · device_code

   Step 2 of 5

   Two codes come back

   In plain words One code is for you to read, the other stays secret inside the TV.

   The user_code is short and shown on screen. The device_code stays on the TV and is used to collect the tokens later. Both expire in minutes.

   {
     "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
     "user_code": "WDJB-MJHT",
     "verification_uri": "https://idp.example.com/device",
     "expires_in": 600,
     "interval": 5
   }

3. enter WDJB-MJHT · approve

   Step 3 of 5

   The user approves on the phone

   In plain words You go to the counter with your phone, give the ticket number and confirm it is you.

   The user opens the link, types the code, signs in with MFA and sees what the TV is asking for. Attackers abuse this step: they send a real code and convince the victim to approve it. Only approve codes you started yourself.

4. POST /token (polling)

   Step 4 of 5

   The TV keeps asking

   In plain words The TV keeps glancing at the counter: "Is my number ready?"

   Every few seconds the TV asks for tokens with the device_code. Until the user approves, the IdP answers authorization_pending; if the TV asks too fast, slow_down.

   POST https://idp.example.com/token
     grant_type=urn:ietf:params:oauth:grant-type:device_code
     &device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS
     &client_id=tv-app
   
   ← 400 { "error": "authorization_pending" }
   ← 400 { "error": "authorization_pending" }
   ← 200 { "access_token": "…", "refresh_token": "…" }

5. access_token + refresh_token

   Step 5 of 5

   The TV is signed in

   In plain words Your number is called: the TV gets its keys and you put the phone away.

   After approval, the next poll returns the tokens. The refresh token lets the TV stay signed in for weeks without asking again.

Flow complete.