# OAuth Device Authorization Grant

OAuth 2.0 Device Authorization Grant is currently available in beta. To try it, [contact support](https://clerk.com/contact/support) to enable it for your workspace.

The grant provides a standards-based flow for applications that cannot open a browser or easily accept text input. CLIs, TVs, game consoles, and other devices can ask a user to approve access from a browser-capable device without entering their credentials on the original device.

## What's new

- **Device authorization and token polling.** Clients request a device code, display a short user code and verification URL, then poll for tokens at the interval Clerk provides.
- **Public and confidential clients.** Public clients send only their Client ID, while confidential clients authenticate with their Client ID and Client Secret.
- **Hosted user verification.** Clerk's Account Portal displays the OAuth application, requested scopes, Organization selection when applicable, and equally visible approve and deny actions.
- **Automatic discovery.** Clerk advertises `device_authorization_endpoint` and `urn:ietf:params:oauth:grant-type:device_code` through OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is available and the verification page is reachable.

Device Authorization Grant follows [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628) and supports the same Clerk OAuth scopes, tokens, consent context, and Organization claims as the Authorization Code Flow. It does not use Proof Key for Code Exchange (PKCE) or redirect URIs.

See [Use OAuth Device Authorization Grant](https://clerk.com/docs/guides/configure/auth-strategies/oauth/device-authorization-grant.md) to configure an OAuth application, implement device and token requests, and handle polling responses.