Log in a device (no keyboard)
Sign in a TV or CLI with the RFC 8628 device flow — a short code, approved on your phone.
Registering an OAuth client needs an invite code, which only an instructor can mint — ask for one at akhil@integrauth.com.
- 1
Register an app with the Device Flow grant enabled, then POST /oidc/device_authorization — /device prints the exact curl, with your own client_id already in it.
A keyboard-less device can’t host a browser redirect, so it asks for a device_code plus a short user_code — both hashed at rest; only the user_code is meant for human eyes.
- 2
On your phone, open /device, type the user_code, and Approve.
Approval happens on a trusted, logged-in device — the TV never sees your passkey, and the code binds this approval to the exact pending request.
- 3
Let the device poll /oidc/token with grant_type=…device_code until it gets tokens.
Polling returns authorization_pending until you approve, slow_down if it polls too fast, then exactly one set of tokens — the device_code is consumed atomically, so a replay is rejected.
Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.