dev/atlas
한국어
/> API design

OpenAPI Device Authorization Flow

OpenAPI 기기 인가 흐름

OpenAPI 3.2 describes the OAuth flow and URLs used by input constrained devices.

···
html
<div class="viz"><h3>DEVICE AUTHORIZATION</h3><div class="device-row"><div class="box">device<br><b id="code">CODE K7</b></div><div class="box" id="approve">browser<br>waiting</div><div class="box" id="token">token<br>pending</div></div><div class="muted" id="device-note">show code on device</div></div>
css
.viz{width:94%;height:88%;max-width:960px;padding:clamp(10px,2vmin,18px);border:1px solid var(--line);border-radius:14px;background:var(--surface);font:600 clamp(12px,1.35vw,16px)/1.35 var(--font-sans,system-ui,sans-serif);display:flex;flex-direction:column;gap:clamp(7px,1.8vmin,13px);overflow:hidden}.viz h3{margin:0;color:var(--accent);font:700 clamp(12px,1.35vw,16px)/1.2 var(--font-sans,system-ui,sans-serif);letter-spacing:.04em}.viz .row{display:flex;align-items:center;justify-content:center;gap:clamp(5px,1.4vmin,12px);flex:1;min-height:0}.viz .box{padding:clamp(5px,1.5vmin,12px);border:1px solid var(--line);border-radius:9px;background:var(--bg);text-align:center}.viz .muted{color:var(--muted)}.viz .accent{color:var(--accent)}.viz .code{font-family:ui-monospace,monospace}.viz .pill{padding:3px 7px;border:1px solid var(--line);border-radius:99px;white-space:nowrap}.viz .active{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,var(--surface))}.viz .arrow{color:var(--accent);font:700 18px ui-monospace,monospace}.device-row{display:flex;align-items:center;justify-content:center;gap:7px;flex:1}.device-row .box{min-width:25%;transition:border-color .3s,background .3s}.device-row .on{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 14%,var(--surface))}#code{color:var(--accent);font:700 12px ui-monospace,monospace}
js
const states=[['waiting','pending','show code on device',0],['approved','pending','user approves in browser',1],['approved','issued','device receives token',2]];let n=0;function draw(){const s=states[n];document.getElementById('approve').innerHTML='browser<br>'+s[0];document.getElementById('token').innerHTML='token<br>'+s[1];document.getElementById('device-note').textContent=s[2];document.querySelectorAll('.device-row .box').forEach((el,i)=>el.classList.toggle('on',i===s[3]));n=(n+1)%states.length}draw();setInterval(draw,850)
···

OpenAPI 3.2

The specification describes HTTP QUERY, additional operations, and streaming representations.

···

API ContractAPI 계약

Paths, requests, responses, and failures form a shared promise between client and server.

···

API VersioningAPI 버저닝

Offer a changed contract as a new version while existing consumers keep working.

···

Content Negotiation콘텐츠 협상

The Accept header asks for a representation and the server selects a supported response type.

OpenAPI 3.2 adds deviceAuthorization to the OAuth Flows Object. A description records the device authorization URL, token URL, and available scopes. In the underlying OAuth flow, a device displays a code, the user approves on another screen, and the device waits for a token.

The demo plays through code display, approval on another screen, and token issuance. An OpenAPI description does not implement the authorization server; polling, expiry, scopes, and errors must follow the OAuth device flow and actual server behavior.

When to use

Use it when documenting API authorization for TVs or CLIs with limited input or browser access.

Open as page ↗