All IAM glossary termsProtocols · glossary
OAuth Device Authorization Grant
Also known as: OAuth Device Flow · Device Code Flow
Definition
The OAuth Device Authorization Grant (RFC 8628) lets devices with limited input (smart TVs, CLI tools, IoT) initiate an OAuth flow that the user completes on a separate device.
In more depth
The flow: the device requests a device_code + user_code from the authorization server, displays the user_code + verification URL to the user, and polls the token endpoint while the user authenticates on their phone/laptop. Once approved, the device receives access + refresh tokens.
This is how `gcloud auth login` works, how Apple TV signs in to streaming apps, and how many CLI tools authenticate. It's an essential pattern for headless / constrained devices.
Deeper reading
Want the work, not just the definition?