Device Code Flow - Authorization

Use this API to start OIDC Device Code Flow on your input-constrained device. The device should instruct the user to open a verification_uri from the response on a secondary device in order to complete the authorization.

Device Code Flow enables OIDC on devices that have an internet connection but don’t have a browser or an easy way to enter text. This flow is seen on devices such as smart TVs, media consoles, picture frames, printers, or hardware video encoders. In this flow, the device instructs the user to open a URL on a secondary device such as a smartphone or computer in order to complete the authorization. There is no communication channel required between the user’s two devices.

Endpoints

To find proper endpoints for your organization’s use, go to https://<mark>*your-subdomain*</mark>.onelogin.com/oidc/2/.well-known/openid-configuration and look for the following code:

"device_authorization_endpoint":
	"https://<mark><em>your-subdomain</em></mark>.onelogin-shadow01.com/oidc/2/device/auth",
"token_endpoint":
	"https://<mark><em>your-subdomain</em></mark>.onelogin-shadow01.com/oidc/2/token",
"grant_types_supported": [
	"urn:ietf:params:oauth:grant-type:device_code",
]

Resource URL

https://<subdomain>.onelogin.com/oidc/2/auth

Resource Parameter

subdomain

required

string

Set to the subdomain of your OneLogin instance.

e.g. oidc-sample where the instance is https://oidc-sample.onelogin.com

Request Parameter

client_id

required

string

The OneLogin generated Client ID for your OpenID Connect app.

scope

required

string

Requires at least "openid".

Sample Response

Response

{
"device_code": "kdoq~tmfPl3f0e2dJaPkUra5mEi",
"user_code": "KGXP-TLFS",
"verification_uri":
	"https://subdomain.onelogin-shadow01.com/oidc/2/device",
"verification_uri_complete":
	"https://subdomain.onelogin-shadow01.com/oidc/2/device?user_code=KGXP-TLFS",
"expires_in": 600,
"interval": 5
}
```json

</div>
</div>


## OIDC Rate Limit
### Authentication
<table style="width: fit-content;">
<thead>
<tr>
<th>
<h4>Type</h4>
</th>
<th>
<h4>Endpoint</h4>
</th>
<th>
<h4>Quantity</h4>
</th>
<th>
<h4>Time</h4>
</th>
<th>
<h4>Burst <em>(per second)</em></h4>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<p>OpenId Connect</p>
</td>
<td>
<p>oidc/auth</p>
</td>
<td>
<p>600</p>
</td>
<td>
<p>minute</p>
</td>
<td>
<p>40</p>
</td>
</tr>
<tr>
<td>
<p>&nbsp;</p>
</td>
<td>
<p>oidc/token</p>
</td>
<td>
<p>1800</p>
</td>
<td>
<p>minute</p>
</td>
<td>
<p>40</p>
</td>
</tr>
<tr>
<td>
<p>&nbsp;</p>
</td>
<td>
<p>oidc/*</p>
</td>
<td>
<p>600</p>
</td>
<td>
<p>minute</p>
</td>
<td>
<p>40</p>
</td>
</tr>
</tbody>
</table>