CLI authentication
A CLI needs browser-based sign-in without opening a local callback listener.
Better Auth · Const
deviceAuthorization
deviceAuthorization enables RFC 8628 device authorization for limited-input clients. Devices obtain codes, users approve them in a browser, and devices poll for a session or OAuth token.
How it works
The plugin enables a device flow for clients with limited input. A device obtains a device code and user code, the user approves the request at the verification route, and the device polls until it receives a Better Auth session token or an OAuth token from the configured integration.
Syntax
deviceAuthorization(options?)Parameters
| Name | Type | Description |
|---|---|---|
options | object | Configuration object; the page demonstrates verificationUri, the route used for user verification. |
Returns
A Better Auth device-authorization plugin configuration used in betterAuth({ plugins: [...] }).
Key points
- It follows RFC 8628's device authorization pattern for issuing codes and obtaining user approval.
- Typical clients include command-line tools, smart TVs, IoT devices, and consoles.
- The initial request returns two values: a device code for polling and a user code for browser approval.
- The user completes authorization by opening the verification page and submitting the displayed code.
- The device must repeatedly check the server rather than wait for a browser callback.
- Successful approval yields either a Better Auth session token or an OAuth access token, depending on configuration.
Common mistakes
- Choose the standalone plugin for a Better Auth session, or add the OAuth Provider when the device needs OAuth access tokens.
Example: Configure device authorization
import { betterAuth } from "better-auth";
import { deviceAuthorization } from "better-auth/plugins";
export const auth = betterAuth({
plugins: [
deviceAuthorization({
verificationUri: "/device",
}),
],
});Adds the device-authorization plugin and sets the route where users verify a displayed user code.
When to use it
Limited-input consumer devices
A smart TV or console cannot conveniently enter credentials.
Connected-device access
An IoT device needs a user-approved Better Auth session.
OAuth device grant
A device client must receive OAuth access tokens.
Interview questions
QWhat problem does device authorization solve?
It implements the OAuth 2.0 Device Authorization Grant for clients that have limited input. The client receives codes, the user authorizes in a browser, and the client polls until authorization completes.
Follow-up: How would you support OAuth access tokens instead of a Better Auth session? Compose device authorization with the OAuth Provider integration.
QDescribe the device flow.
The device calls the device-code endpoint with a client ID to obtain a device code and user code. It then directs the user to the verification URI and polls the token endpoint.
Follow-up: What happens if the user has not approved yet? Continue polling according to the endpoint's pending response and stop when authorization succeeds or the flow expires.
QHow is the plugin configured?
Configure the plugin in the server's Better Auth configuration, optionally providing a verification URI such as /device. Add the corresponding client plugin when using the client-side API.
Follow-up: What application responsibility remains after configuration? Implement the verification and approval UI at the configured route.
Related
deviceAuthorizationClientdevice.codedevice.tokenoauthProvideroauthDeviceAuthorization