Using Auth0 in your applications means that you will be "outsourcing" the authentication process to a centralized login page in the same way that Gmail, YouTube, and any other Google property redirects to accounts.google.com whenever a user signs in.
With input-constrained devices, however, rather than immediately authenticating the user, the device asks the user to go to a link on their computer or smartphone to authenticate. This avoids a poor user experience for devices that do not have an easy way to enter text. If you’ve ever signed in to your Netflix account on a device like a Roku, you’ve already encountered this workflow.
Your user will authenticate on their computer or smartphone, and Auth0 will generate an Access Token that will be passed back to your device application. The Access Token can then be used to call your API.
This flow can be used with native applications only.
When your app needs to fetch user data from your API:
- If the device is not already authorized, your device app calls your Auth0 Authorization Server to retrieve a device code.
- Auth0 responds with a URL and user code that your device app can use when asking the user to visit a specific URL on their laptop or smartphone and provide an activation code.
- Your device app begins to poll your Auth0 Authorization Server for an Access Token.
- The user authenticates with Auth0 on its computer or smartphone using one of your configured login options (e.g., username/password, social identity provider, SAML).
- Auth0 responds to your device app with an Access Token.
- The Access Token can be used to call your API and retrieve requested data.
For devices, Auth0 uses the Device Authorization Flow.
1
Configure your API
Once you have created your API, you will need to authorize your device's application and configure any scopes that applications can request during authorization.
2
Get an Access Token
Your device requests an Access Token from your Auth0 Authorization Server using the
Device Authorization Flow.
3
Call your API
When your device calls your API, it includes the retrieved Access Token in the HTTP Authorization header.
To implement the Device Authorization Flow, you can follow our tutorial: Call Your API Using the Device Authorization Flow.
Keep reading
Guides
Step-by-step instructions for tasks
References
API endpoints, libraries, and best practices
Concepts
Understand the fundamentals