device-authorization

To authenticate a CLI tool without a browser redirect, implement the RFC 8628 device authorization grant flow. This allows users to approve login requests via a separate browser session while the application polls for a token.

The RFC 8628 device authorization grant is used for authenticating applications lacking browser redirect capabilities. It enables secure user approval for devices with limited input capabilities, such as CLI tools, desktop applications, and IoT devices.

Device code flow authentication works by having the IoT device request a code, prompting the user to visit a URL on a separate browser session to approve the login, and then polling the authorization server until successful token exchange.

Yes, you can use device auth to obtain verifiable BAP identity claims for AI agents. It provides a secure mechanism for autonomous services to authenticate and receive identity tokens upon successful exchange.

RFC 8628 device authorization is suitable for desktop applications, CLI tools, and IoT devices. It specifically addresses scenarios where applications cannot handle browser redirects directly, enabling authentication via a separate device.

Your CLI authentication requires a separate browser session because the device authorization flow offloads the user approval step to a device with browser capabilities. This allows limited-input devices to securely complete token polling.