Page Comparison

Introduction

...

...

1. User Turn on device (e.g: STB) first time
2. User is prompted with a random 8 characters code (aka user_code)
3. User is prompted to go to a website to login (authenticate)
4. Once successfully authenticated, user will be asked to enter the user_code from step 2
5. User enter user_code and submit it
6a. If user_code is valid => the device (in #1) will be successfully login => user can start streaming services entitled to his/her account.
6b. If user_code is invalid => the device (in #1) will prompt user that login was failed => user won't be able to use any services.

Requesting a user_code:

When the user wants to log in, the device starts out by making a POST request to begin the process. The POST request contains only one piece of information, its client_id. This request is made to a /api/auth/v1/device endpoint that is unique to the Device Flow.

...

{
"device_code": "NGU4QWFiNjQ5YmQwNG3YTdmZMEyNzQ3YzQ1YSA",
"verification_uri": "https://example.com/device",
"user_code": "BDSDABCD-HQMK1234",
"expires_in": 1800,
"interval": 5
}

...

• device_code - This is a long string that the device will use to eventually exchange for an access token.
• verification_uri - This is the URL the user needs to enter into their phone to start logging in.
• user_code - This is the text the user will enter at the URL above.
• expires_in - The number of seconds that this set of values is valid. After this amount of time, the device_code and user_code will expire and the device will have to start over.
• interval - The number of seconds the device should wait between polling to see if the user has finished logging in.

Verification: 

User logs in with regular authentication mechanism to the service from mobile phone/browser, then enters the verification_uri provided by the device endpoint, a POST request is made to /api/auth/v1/device/verify endpoint to verify the user.

curl -X POST "https://testing.booxmedia.xyz/api/auth/v1/device/verify" -H "accept: */*" -H "Content-Type: application/json" -d "{\"user_code\":\"ABCD-1234\",\"user_id\":\"1234\"}"

Now the device needs to display the URL and User Code to the user. While the device waits for the user to enter the code and log in, it will make a POST request every 5 seconds as specified by the interval returned. This POST request will be made to the /api/auth/v1/access_tokenendpoint, using a grant type of urn:ietf:params:oauth:grant-type:device_code

POST https://authorization-server.com/token

grant_type=urn:ietf:params:oauth:grant-type:device_code
&client_id=CLIENT_ID
&device_code=NGU4QWFiNjQ5YmQwNG3YTdmZMEyNzQ3YzQ1YSA

...