设备授权授予
学习 OAuth2 设备授权授予（RFC 8628），了解输入受限设备（如智能电视、游戏主机和 CLI 工具）如何通过辅助设备获取令牌。
设备授权授予 是 CoddyKit 上的免费 OAuth2 & OpenID Connect Deep Dive 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 OAuth2 & OpenID Connect Deep Dive 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Why a Device Grant?
Some clients have no browser or only a limited keypad: smart TVs, media consoles, printers, and CLI tools. The classic Authorization Code Flow assumes a rich browser for the user-agent redirect, which these devices cannot provide.
The Device Authorization Grant (RFC 8628) solves this by letting the user complete authorization on a second device (phone or laptop) while the constrained device polls for the result.
The Two Endpoints
The flow introduces a new device authorization endpoint alongside the standard token endpoint.
/device_authorization— the device requests codes here./token— the device polls here with grant typeurn:ietf:params:oauth:grant-type:device_code.
No redirect URI is involved at all.
Step 1: Requesting Device Codes
The device makes a POST to the device authorization endpoint with its client_id and desired scope.
POST /device_authorization HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded
client_id=tv-app-123&scope=profile emailStep 2: The Response
The server returns a device_code (used by the machine), a user_code (typed by the human), a verification_uri, an expires_in, and an interval for polling.
{
"device_code": "GmRhmhcxhwAzkoEqiMEg",
"user_code": "WDJB-MJHT",
"verification_uri": "https://example.com/device",
"expires_in": 900,
"interval": 5
}Step 3: User Instructions
The device displays a short message: Go to example.com/device and enter code WDJB-MJHT.
A verification_uri_complete may also be returned, embedding the code so a QR code can carry the whole link.
Step 4: User Authorizes
On their phone or laptop, the user opens the verification URI, logs in, enters the user_code, and approves the requested scopes. This happens in a full browser, so MFA and rich consent screens all work normally.
Step 5: Device Polls the Token Endpoint
Meanwhile the device polls the token endpoint at the given interval, sending the device_code.
POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:device_code
&device_code=GmRhmhcxhwAzkoEqiMEg
&client_id=tv-app-123Polling Responses
Until the user finishes, the server returns errors that tell the device how to behave:
authorization_pending— keep polling, user has not approved yet.slow_down— increase the interval by 5 seconds.access_denied— user rejected; stop.expired_token— codes expired; restart.
Step 6: Success
Once the user approves, the next poll returns a normal token response with an access_token (and optionally a refresh_token), exactly like other grants.
{
"access_token": "eyJhbGciOi...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "8xLOxBtZp8"
}A Simple Poll Loop
A pseudo-implementation of the polling logic, respecting slow_down:
let interval = 5;
while (true) {
await sleep(interval * 1000);
const res = await pollToken(deviceCode);
if (res.access_token) return res;
if (res.error === 'slow_down') interval += 5;
else if (res.error === 'authorization_pending') continue;
else throw new Error(res.error);
}Security Considerations
Keep user_codes short but high-entropy to resist brute force, and rate-limit the verification page. Because there is no redirect, phishing risk shifts to the verification URI — always show the user exactly which app and scopes they are approving.
Quick Check
Test your understanding of the device grant.
Recap
The Device Authorization Grant lets browserless devices authenticate users via a second device.
- Device gets a
device_code+user_codefrom the device endpoint. - User approves on a phone/laptop at the verification URI.
- Device polls the token endpoint, handling
authorization_pendingandslow_down. - On approval it receives normal access and refresh tokens.
常见问题解答
「设备授权授予」课时是免费的吗？
是的 — 「设备授权授予」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 OAuth2 & OpenID Connect Deep Dive 课程的其余内容，请升级到 CoddyKit PRO。 OAuth2 & OpenID Connect Deep Dive 课程共包含 4 节课。
「设备授权授予」这节课中我会学到什么？
学习 OAuth2 设备授权授予（RFC 8628），了解输入受限设备（如智能电视、游戏主机和 CLI 工具）如何通过辅助设备获取令牌。 你通过在浏览器中直接运行的动手代码来练习 OAuth2 & OpenID Connect Deep Dive，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 OAuth2 & OpenID Connect Deep Dive 需要有经验吗？
无需任何先前经验。CoddyKit 上的 OAuth2 & OpenID Connect Deep Dive 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「设备授权授予」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 OAuth2 & OpenID Connect Deep Dive 课中编写并运行代码吗？
能。每节 OAuth2 & OpenID Connect Deep Dive 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。