Device Authorize

Device Authorization endpoint (RFC 8628 Section 3.1).

Called by CLI clients to obtain a device_code + user_code pair. No authentication required — this is a public endpoint.

Limited per client address to oauth_device_authorize_rate_limit_per_minute requests per minute (#1656). Over the limit it returns 429 in the RFC 6749 §5.2 error shape (RFC 8628 §3.2) with Retry-After, before any row is written.

The body is application/x-www-form-urlencoded (RFC 8628 §3.1) or application/json (#1671). It is read after the limit is counted, so a refused body still counts. A missing or unsupported Content-Type, a malformed body or a missing client_id returns 400 invalid_request, an oversized body returns 413 invalid_request, an unknown client_id returns 400 invalid_client, an admin-managed client registered without a memory scope returns 400 invalid_scope and a failure to store the grant returns 500 server_error, all in the RFC 6749 §5.2 error shape.

The granted scope follows granted_scope (#1686), as at /authorize.