Public, form-encoded, no session required (rate-limited like /token). Validates the client, checks it is allowed the device-code grant, validates requested scopes against the client's registered scopes, then issues an opaque device_code (stored only as an HMAC digest) plus a human-typable user_code.

Follows RFC 8628 §3.1–§3.2.

Example

POST /api/v0/main-frontend/oauth/device_authorization HTTP/1.1
Content-Type: application/x-www-form-urlencoded

client_id=tmc-vscode&scope=exercise-services

Successful response:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
  "user_code": "WDJB-MJHT",
  "verification_uri": "https://courses.mooc.fi/oauth_device",
  "verification_uri_complete": "https://courses.mooc.fi/oauth_device?user_code=WDJB-MJHT",
  "expires_in": 900,
  "interval": 5
}