Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
OAuth device flow lets a command-line tool or AI agent obtain delegated access when it cannot conveniently open a browser or accept a browser redirect. The client requests a short, human-entered code, shows a verification address, and waits while you approve the request on a phone or computer. It then polls the authorization server and receives an access token, and sometimes a refresh token, without asking the terminal to handle your password. The standardized name is the OAuth 2.0 Device Authorization Grant, defined in RFC 8628 (published by the IETF in August 2019).
What is OAuth device flow?
OAuth device flow is a grant for an internet-connected client that lacks a suitable browser or has impractical text input. A CLI on a remote server, a television, a headless appliance, or an AI agent can display a URL and a short user code while the user completes sign-in and consent on another device.
As an Amazon Associate I earn from qualifying purchases.
The terminal is not logging in by handing a password to the application. Instead, an authorization server creates a temporary authorization session. The user authenticates at that server, reviews the requested scopes, and approves or denies the session. The client later exchanges the approved session for bearer credentials at the token endpoint.
RFC 8628 explicitly says this grant is not a replacement for browser-based OAuth in capable native applications such as smartphones. Device flow is useful when opening a browser or receiving an incoming redirect is difficult, not simply because it is an alternative developers happen to prefer.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Why does a terminal show a URL and a short code?
The short user code is designed for a person to type, while the longer device code remains protocol data exchanged by the client. Showing the human-facing code lets you approve a particular terminal session without asking you to copy sensitive device credentials into a browser.
A typical prompt includes:
- A verification URI that you open on a phone or computer.
- A short user code that you enter at that URI.
- The account, device, or session the client says it is trying to authorize.
- The scopes or permissions the application is requesting.
- A clear way to cancel instead of approving.
Providers may also return a complete verification URI suitable for a QR code or another non-textual shortcut. A good client still prints the text URI and user code so the request remains accessible and can be checked manually.
How does the OAuth device-code sequence work?
The exchange has six distinct stages. The client should begin only after the user asks it to authenticate; it should not silently create a new authorization session every time it starts or whenever an earlier session fails.
- Request a device authorization. Over outbound HTTPS, the client sends its client identifier and requested scope to the provider’s device-authorization endpoint. The request is user-triggered, rather than an automatic startup action.
- Receive temporary session values. The authorization server returns a
device_code, auser_code, averification_uri, and a requiredexpires_invalue. It may return anintervalfor polling and may provide a complete verification URI for QR presentation. - Display a safe prompt. The CLI or agent prints the verification URI and user code, explains the requested access, and tells you to approve on a second device. It must never present the device code as if it were the code you should type.
- Approve elsewhere. You visit the verification URI, sign in, confirm that the displayed device or session is yours, and accept or decline the request. The authorization server should help you check that the code and device match, which reduces phishing and device-impersonation risk.
- Poll the token endpoint. The client posts the device code with
grant_type=urn:ietf:params:oauth:grant-type:device_code. It waits at least the returned interval, or five seconds when no interval was supplied, before making the next request. - Finish on a defined result. Approval returns an access token and may also return a refresh token.
authorization_pendingmeans the client should continue at the permitted rate;access_deniedmeans it must stop;expired_tokenmeans the temporary session ended and a new, user-initiated request may be needed.
The device code is high-entropy session material. Treat it like a credential: do not ask a user to type it, print it in logs, or paste it into support tickets.
What does a CLI or AI agent need before it can use device flow?
Four practical conditions must be present: the client needs outbound HTTPS, a way to show a URI and user code, a token endpoint it can poll, and a person with a second device for authentication and consent.
| Requirement | Why it matters | Typical failure when absent |
|---|---|---|
| Outbound HTTPS | Device authorization and token polling are network exchanges with the authorization server. | A firewall, proxy, DNS problem, or TLS failure prevents either request. |
| Human-readable prompt | The user must see the verification URI, user code, requested scopes, and cancellation guidance. | The user cannot identify what to approve or where to approve it. |
| Secondary device | Sign-in and consent happen in a browser on a phone or computer rather than in the constrained client. | A headless host has no practical place to complete authentication. |
| Secure token storage | Returned access and refresh tokens are bearer credentials. | Tokens leak through shell history, logs, process output, or unprotected files. |
Device flow does not remove the need for an OAuth client registration, allowed scopes, or provider support for the device authorization grant. Those details are configured by the service that owns the authorization server.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How should polling be implemented?
Polling is a small state machine, not a tight loop. Respect the server’s timing instructions and make every terminal state visible to the user.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Token-endpoint result | Client action |
|---|---|
| Success | Store the access token and, if returned, the refresh token using the operating system’s secure facilities. Continue to the requested operation without printing either token. |
authorization_pending |
Wait for the current interval and poll again while the device authorization remains valid. |
slow_down |
Increase the interval by five seconds for subsequent requests, then continue only if the authorization has not expired. |
access_denied |
Stop immediately and explain that the user declined the request. Do not create another session automatically. |
expired_token |
Stop polling and tell the user to start a new login from an explicit command or action. |
When no interval is supplied, RFC 8628 requires a five-second minimum between polls. A client should use a timer rather than repeatedly issuing requests while waiting for approval. The same pacing rules apply to an agent running without an interactive terminal.
How can an AI agent request permission safely?
An agent should treat device flow as a human approval boundary, not as a way to obtain unattended authority. The agent may prepare the request and display its verification details, but a person must decide whether the scopes and target device are appropriate.
Make the request explicit
Start the flow only after a user action such as “connect my account.” Do not launch a new device authorization at process startup, after every failed session, or on a timer. This prevents a malfunctioning agent from generating a stream of approval prompts.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Show the exact authority being granted
List scopes in plain language before the user opens the verification URI. Identify the machine or session that will receive the token and provide a cancel option. If the provider displays a device name or confirmation code, ask the user to compare it with the terminal’s prompt.
Keep secrets out of the model context
The agent can relay a verification URI and user code, but it should not expose the device code or resulting tokens in chat transcripts, tool traces, telemetry, or logs. Store tokens in an operating-system credential store where available, and pass them to API calls through protected process memory or the provider’s supported library.
Use a supported library when one exists
Authentication libraries handle provider-specific registration, token parsing, refresh behavior, and error handling. Microsoft recommends supported libraries such as MSAL for applications using Microsoft Entra rather than hand-coding the entire protocol when a suitable library fits the application.
What are the main security risks?
The protocol’s unusual two-device design creates clear checks that both the client and the user must perform.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Phishing or device impersonation: A malicious prompt could direct you to approve a different device. The client should identify the device, and the authorization server should let you verify that the displayed code and device match.
- Code guessing: An attacker who guesses a valid session value could attempt to obtain authorization. Providers therefore need very high-entropy device codes; clients should never shorten, transform, or reveal them as the user code.
- Transport interception: Device authorization and token requests must use TLS-protected HTTPS. A client should reject insecure endpoints rather than silently downgrade.
- Credential leakage: Access and refresh tokens are bearer credentials. Avoid terminal echo, debug logging, crash reports, and world-readable token files.
- Excessive polling: Polling faster than allowed can trigger
slow_down, waste resources, or cause a provider to reject the session. The interval is part of the protocol contract.
What is the difference between device flow and browser authorization-code flow?
Both flows let a user authorize an application without giving the application a password, but they solve different client constraints.
| Comparison point | Device authorization grant | Browser authorization-code flow |
|---|---|---|
| Client environment | Designed for headless, input-constrained, or browserless clients. | Designed for clients that can open a browser and handle a redirect. |
| User interaction | The client prints a URI and short code; approval happens on a second device. | The client launches or redirects to a browser and receives a callback. |
| Text entry | Only the short user code should be typed; the device code stays with the client. | Normally little or no manual code entry is required. |
| Client waiting behavior | The client polls the token endpoint at the provider’s interval until approval, denial, or expiry. | The redirect response normally returns the authorization result to the waiting client. |
| Best fit | CLIs, remote shells, TVs, appliances, and constrained agents. | Capable native apps and browser-enabled clients. |
| Device identification | The user must verify which terminal or session is being approved. | The browser redirect ties the response to the initiating application session. |
For a smartphone or desktop app that can use a browser and receive a redirect, follow the browser-based native-app practices referenced by RFC 8628 instead of choosing device flow merely for convenience.
How long does a device-code login remain valid?
Validity is provider-specific and is carried in the required expires_in response value. Microsoft Entra’s documented device-code flow gives the user 15 minutes by default from the device-code request to sign in; that figure applies to Microsoft’s service and should not be generalized to every OAuth provider.
A client should display an understandable countdown or expiry message when practical. Once the session expires, stop polling and require a fresh, user-triggered authorization request. Do not recycle an old device code or create a replacement silently.
Recommended Free Tools
How do I implement a reliable device-flow client?
A minimal implementation can follow this provider-neutral outline. Endpoint paths, client registration, scope names, response formats, and token storage APIs remain provider-specific.
- Register the client with an authorization server that supports RFC 8628 and obtain its client identifier.
- On an explicit login command, send the client identifier and requested scope to the device-authorization endpoint over HTTPS.
- Validate that the response includes
device_code,user_code,verification_uri, andexpires_in. Use the returnedinterval, defaulting to five seconds when it is absent. - Print the verification URI, user code, requested permissions, device identity, expiry information, and a cancellation instruction. Optionally render a QR code from the complete verification URI.
- Wait for the interval, then POST the device code and
grant_type=urn:ietf:params:oauth:grant-type:device_codeto the token endpoint. - Handle success,
authorization_pending,slow_down,access_denied, andexpired_tokenas separate states. Increase the interval by five seconds afterslow_down. - Save returned credentials in the host operating system’s secure storage and redact them from logs, errors, and agent messages.
Do not start polling before the first interval has elapsed, and do not keep polling after a terminal error. A cancellation key or command should interrupt the wait and discard the temporary session locally.
Why is my device-code login stuck polling?
Most “stuck” sessions are waiting normally, but a few observable conditions distinguish a valid wait from a broken implementation.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The user has not completed approval
Check that the displayed URI and user code were entered on the second device, that the correct account was used, and that the requested scopes were accepted. Until approval occurs, authorization_pending is expected.
Free tools Windows power users keep installed
One-click scans. No signup required.
The client is polling too quickly
Honor the provider’s interval. If the server returns slow_down, add five seconds to the interval for every later request; do not respond by retrying immediately.
The network cannot reach the endpoints
Verify outbound HTTPS, DNS, proxy rules, certificate validation, and whether the token endpoint is reachable from the same host that requested the device code. A browser on your phone may work even while the headless machine is blocked.
The session has expired or was denied
Stop the current loop when the server reports expired_token or access_denied. Start again only after the user explicitly asks for another authorization.
The prompt is ambiguous
If the user cannot tell which device or permissions are being approved, improve the client prompt rather than asking for the hidden device code. Show the text URI, short code, scopes, and device identity together.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen should you choose OAuth device flow?
Choose it when a client is internet-connected but cannot reliably open a browser, receive a redirect, or accept enough text for a conventional login. It is a strong fit for command-line tools on remote hosts, headless services that still have a human operator, TVs, and constrained AI-agent interfaces.
Choose browser authorization-code practices instead when the application runs on a capable phone or desktop and can use a normal browser redirect. Device flow adds a second-device handoff and polling, so it is not automatically simpler or more secure for every client.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently asked questions
Is OAuth device flow a passwordless login?
No. It is an OAuth authorization grant, not an authentication method by itself. The user may still authenticate with a password, multifactor authentication, passkey, or another method selected by the authorization server; the client receives delegated tokens rather than the user’s password.
Can I shorten the waiting time by polling every second?
No. The returned interval is the minimum pacing guidance, and five seconds is the default when no interval is supplied. Polling faster can produce slow_down; the correct response is to back off, not to increase request frequency.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat should I do if I close the browser before approving?
Leave the terminal session running only if the device authorization has not expired and you intend to finish it. Otherwise cancel the wait and begin a new request from an explicit login action; never reuse an expired device code.
Will every provider return a refresh token?
No. A successful device-code exchange returns an access token and may also return a refresh token, depending on the provider, client registration, and scopes. Code should handle the absence of a refresh token and protect either credential type as a bearer secret.
Is a QR code required for device flow?
No. QR presentation is optional. The protocol requires a way to show a verification URI and user code; a complete URI and QR code can reduce typing, while the text form remains important for accessibility and verification.
Frequently Asked Questions
Is OAuth device flow a passwordless login?
No. It is an OAuth authorization grant, not an authentication method by itself. The user may still authenticate with a password, multifactor authentication, passkey, or another method selected by the authorization server; the client receives delegated tokens rather than the user’s password.
Can I shorten the waiting time by polling every second?
No. The returned interval is the minimum pacing guidance, and five seconds is the default when no interval is supplied. Polling faster can produce slow_down; the correct response is to back off, not to increase request frequency.
What should I do if I close the browser before approving?
Leave the terminal session running only if the device authorization has not expired and you intend to finish it. Otherwise cancel the wait and begin a new request from an explicit login action; never reuse an expired device code.
Will every provider return a refresh token?
No. A successful device-code exchange returns an access token and may also return a refresh token, depending on the provider, client registration, and scopes. Code should handle the absence of a refresh token and protect either credential type as a bearer secret.
Is a QR code required for device flow?
No. QR presentation is optional. The protocol requires a way to show a verification URI and user code; a complete URI and QR code can reduce typing, while the text form remains important for accessibility and verification.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
