/device/authorize

Request

CORS

Returns a user code, device code, activation link, and QR code activation link

Bodyapplication/x-www-form-urlencoded

client_idstring

Obtained during either manual client registration or through the Dynamic Client Registration API. It identifies the client and must match the value preregistered in Okta.

scopestring

A list of scopes that the client wants to include in the access token

curl -i -X POST \
  https://subdomain.okta.com/oauth2/v1/device/authorize \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=string \
  -d scope=string

Responses

Based on the type of token and whether it's active, the returned JSON contains a different set of information.

Bodyapplication/json

device_codestring

The device verification code

expires_ininteger

The expiration time of the device_code and user_code in seconds

intervalinteger

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint

user_codestring

The verification code for the end user

verification_uristring

The URI that the end user visits to verify

verification_uri_completestring

The URI that includes the user_code that the end user alternatively visits to verify

Response

{
  "user_code": "RGTCFDTL",
  "device_code": "5cbeb234-7e00-4ff7-9aa2-b1a4558a75d2",
  "interval": 5,
  "verification_uri_complete": "https://{yourOktaDomain}/activate?user_code=RGTCFDTL",
  "verification_uri": "https://{yourOktaDomain}/activate",
  "expires_in": 600
}