Device Authorization Flow

import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.yourdomain.com',
  clientId: 'your-device-app-client-id',
})
 
// Step 1: Request a device code
const deviceAuth = await fetch('https://auth.yourdomain.com/api/oauth/device/code', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    client_id: 'your-device-app-client-id',
    scope: 'openid profile email',
  }),
}).then(r => r.json())
 
// Step 2: Display to the user
console.log(`Go to: ${deviceAuth.verification_uri}`)
console.log(`Enter code: ${deviceAuth.user_code}`)
 
// Step 3: Poll for the token
const token = await pollForToken(deviceAuth)
 
async function pollForToken(deviceAuth) {
  const interval = deviceAuth.interval * 1000 // convert to ms
  const expiresAt = Date.now() + deviceAuth.expires_in * 1000
 
  while (Date.now() < expiresAt) {
    await new Promise(resolve => setTimeout(resolve, interval))
 
    const response = await fetch('https://auth.yourdomain.com/api/auth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: deviceAuth.device_code,
        client_id: 'your-device-app-client-id',
      }),
    })
 
    if (response.ok) {
      return await response.json()
    }
 
    const error = await response.json()
 
    if (error.error === 'authorization_pending') {
      continue // user hasn't approved yet
    }
    if (error.error === 'slow_down') {
      await new Promise(resolve => setTimeout(resolve, 5000)) // back off
      continue
    }
    if (error.error === 'expired_token') {
      throw new Error('Device code expired. Please restart the flow.')
    }
    if (error.error === 'access_denied') {
      throw new Error('User denied the authorization request.')
    }
 
    throw new Error(`Unexpected error: ${error.error}`)
  }
 
  throw new Error('Device code expired.')
}

# Step 1: Request a device code
curl -X POST https://auth.yourdomain.com/api/oauth/device/code \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=your-device-app-client-id" \
  -d "scope=openid profile email"
 
# Response:
# {
#   "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
#   "user_code": "WDJB-MJHT",
#   "verification_uri": "https://auth.yourdomain.com/hosted/device",
#   "verification_uri_complete": "https://auth.yourdomain.com/hosted/device?user_code=WDJB-MJHT",
#   "expires_in": 600,
#   "interval": 5
# }
 
# Step 2: User visits verification_uri and enters user_code
 
# Step 3: Poll for the token (repeat every `interval` seconds)
curl -X POST https://auth.yourdomain.com/api/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS" \
  -d "client_id=your-device-app-client-id"
 
# Pending response (HTTP 400):
# { "error": "authorization_pending" }
 
# Success response (HTTP 200):
# {
#   "access_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
#   "scope": "openid profile email"
# }

#!/usr/bin/env node
// Example: CLI tool login flow with device authorization
 
import open from 'open'
import readline from 'readline'
 
const AURIS_DOMAIN = 'https://auth.yourdomain.com'
const CLIENT_ID = 'your-cli-client-id'
 
async function login() {
  // Request device code
  const codeResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/device/code`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ client_id: CLIENT_ID, scope: 'openid profile' }),
  }).then(r => r.json())
 
  console.log('\n  Your authorization code is:\n')
  console.log(`    ${codeResponse.user_code}\n`)
  console.log(`  Visit: ${codeResponse.verification_uri}\n`)
 
  // Attempt to open the browser automatically
  const uriComplete = codeResponse.verification_uri_complete
  if (uriComplete) {
    console.log('  Opening browser...')
    await open(uriComplete)
  }
 
  // Poll for token
  console.log('  Waiting for authorization...\n')
 
  let interval = codeResponse.interval * 1000
  const deadline = Date.now() + codeResponse.expires_in * 1000
 
  while (Date.now() < deadline) {
    await new Promise(r => setTimeout(r, interval))
 
    const res = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: codeResponse.device_code,
        client_id: CLIENT_ID,
      }),
    })
 
    if (res.ok) {
      const token = await res.json()
      console.log('  Authenticated successfully!')
      return token
    }
 
    const err = await res.json()
    if (err.error === 'slow_down') {
      interval += 5000
    } else if (err.error !== 'authorization_pending') {
      throw new Error(`Authorization failed: ${err.error}`)
    }
  }
 
  throw new Error('Authorization timed out.')
}
 
login()
  .then(token => console.log('Token:', token.access_token.slice(0, 20) + '...'))
  .catch(err => console.error(err.message))