---
title: "Device Authorization Endpoint"
method: POST
path: "/realms/public/protocol/openid-connect/auth/device"
tags: ["auth-keycloak"]
---

# Device Authorization Endpoint

`POST /realms/public/protocol/openid-connect/auth/device`

OAuth 2.0 Device Authorization Request (RFC 8628 §3.1/§3.2).

The CLI POSTs here to start a device flow. We mint a high-entropy
`device_code` (stored only as sha256) plus a short human-typed `user_code`
(stored RAW — it is low-entropy and must be looked up by the human, so its
safety is single-use + rate-limit + a 600s TTL, not length). The CLI then
polls /token while the human visits `verification_uri` on the portal.

There is NO redirect_uri (device flow has none). PKCE is OPTIONAL and, when
supplied, is bound to the row and verified at /token — never at the portal.

## Response `200`

Successful Response

- unknown

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) · [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geopera/geopera-data-platform/revisions/cb0130b2a40a/schema)