OAuth 2.0 Device Authorization Grant (RFC 8628)

1. Device authorization request

   Requesting a device_code and user_code.

2. Device authorization response

   verification_uri, expires_in and polling interval.

3. User interaction

   Entering the user code on a secondary device.

4. Device access token request

   Polling the token endpoint with the device_code grant type.

5. Device access token response

   authorization_pending, slow_down and access_denied errors.

6. Security considerations

   Brute forcing user codes and remote phishing.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.