OAuth 2.0 Device Authorization Grant

Some devices aren’t suited for typing. A TV only has a remote control, a game console only a gamepad, and a smart speaker has no input at all. Yet you still need to be able to sign in there to a service like Netflix, Spotify, or YouTube. The OAuth 2.0 Device Authorization Grant solves this problem by shifting the login to a second device. The TV only displays a short code. You enter the password and confirmation on your phone or laptop, where it’s convenient and secure to do so.

Why TVs shouldn’t ask for passwords

Typing a password using a remote control is tedious. You click your way letter by letter through an on-screen keyboard. With a long, secure password this takes minutes. Many users therefore choose weak passwords or abandon the login entirely.

But the security aspect is more important. A TV in the living room is a device you can trust less than your own phone. It’s rarely updated, shares the Wi-Fi with guests, and runs software from the manufacturer. With the Device Flow, this device never gets to see the password. In the end, it only receives a token – a limited digital key for exactly this one service.

There’s also a practical advantage: two-factor methods work without any issues. The confirmation code from the authenticator app is entered on the phone, not on the TV. Without the Device Flow, this would hardly be feasible on many devices.

The journey from the code on the screen to access

The process starts at the device. The TV contacts the service and effectively says: a user wants to sign in. The service responds with two codes. One is short and human-readable, something like ABCD-1234. The other is long, secret, and intended only for the device. Along with this comes a web address where the confirmation takes place.

The TV now displays the short code and the address, often additionally as a QR code. The user opens the page on their phone, logs in there normally, and enters the short code. The service then asks: should this device be granted access to your account? Only by clicking Yes is the authorization granted.

Meanwhile, the TV isn’t just waiting idly. Every few seconds it asks the service whether authorization has been granted yet. This repeated checking is called polling. As long as nothing has happened, the answer is simply: not yet. After confirmation, the service delivers the token, and the TV is signed in. The short code usually expires after ten to fifteen minutes so that it doesn’t remain valid indefinitely.

From Netflix to the command line

You most commonly encounter this procedure on the couch. Streaming apps on smart TVs, Fire TV sticks, and consoles nearly all use it. The typical code also appears when setting up Google Home, Alexa devices, or a smartwatch. If you’ve ever seen a string of letters on a screen with a short web address below it, you’ve used the Device Flow.

The second major area of use is among developers. When you sign in to GitHub or a cloud provider from a terminal window, the same process often appears. The command-line program can’t display a login page, so it points you to the browser instead. Tools for managing AI services also use this method.

A common misconception is that the code is a password. It’s merely a number for a pending request. Still, you shouldn’t share it. Scammers sometimes send a code by email and ask for confirmation. Anyone who agrees allows a stranger’s device to access their own account. The rule is simple: only confirm codes that you are currently seeing yourself on your own screen.