/device/authorize

Request

CORS

Returns a user code, device code, activation link, and QR code activation link

Path

authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded

client_idstring

Obtained during either manual client registration or through the Dynamic Client Registration API. It identifies the client and must match the value preregistered in Okta.

resourceArray of strings, (uri)

An absolute URI that identifies the target resource server for the device authorization request.

Repeat the parameter to authorize multiple resource servers (?resource=https://api.example.com&resource=https://other.example.com, for example). Each access token is issued for a single resource server, so its aud claim is a single value. If you specify more than one resource server, use the resource parameter in the /token request to select one. Values that aren't audiences of the authorization server are ignored.

Note: Multiple audiences for custom authorization servers is a self-service Early Access (EA) feature. See Manage Early Access and Beta features to enable the feature.

scopestring

A list of scopes that the client wants to include in the access token

curl -i -X POST \
  'https://subdomain.okta.com/oauth2/{authorizationServerId}/v1/device/authorize' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=string \
  -d resource=http://example.com \
  -d scope=string

Responses

Based on the type of token and whether it's active, the returned JSON contains a different set of information.

Bodyapplication/json

device_codestring

The device verification code

expires_ininteger

The expiration time of the device_code and user_code in seconds

intervalinteger

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint

user_codestring

The verification code for the end user

verification_uristring

The URI that the end user visits to verify

verification_uri_completestring

The URI that includes the user_code that the end user alternatively visits to verify

Response

{
  "user_code": "RGTCFDTL",
  "device_code": "5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2",
  "interval": 5,
  "verification_uri_complete": "https://{yourOktaDomain}/activate?user_code=RGTCFDTL",
  "verification_uri": "https://{yourOktaDomain}/activate",
  "expires_in": 600
}