Overview

Device Code Flow is an OAuth 2.0 authorization method designed for applications that cannot open a browser or host a redirect URI. These include command-line tools, background services, kiosks, and devices with limited UI. Instead of authenticating directly, the device displays a verification URL and a short user code. The user completes authentication on another device, and the application polls until authorization is granted. A Device Code Flow Application must be registered so it can receive a Client ID and request the correct Scopes for API access.

When Device Code Flow Is Used

• Applications without a browser or with limited UI

• PowerShell or CLI utilities

• Devices that cannot securely store secrets

• Scenarios where authentication happens on a separate device

Device Code Flow applications do not use a client secret and are treated as public clients.

Prerequisites

• Access to the identity provider’s application registration portal

• Permission to create OAuth applications

• Knowledge of which APIs the application must access

• The list of required scopes (for example: rapidadmin.api, eliteid.api, offline_access)

Creating the Device Code Flow Application

1. Open up RapIDAdmin

2. Navigate to the application management area

3. Create a New Application

Create a new OpenID Connect Application inside RapIDAdmin and configure it as follows:

• Name: My Device Code Flow App (Could say “Bob”)

• OAuth Grant Type: Device Code

• Scopes (Api Permissions): RapIDAdmin Api EliteID Api

• rapidadmin.api

• eliteid.api

• offline_access (required for refresh tokens)

The scopes you assign in the RapIDAdmin OpenID Connect application must match the scopes your script or tool requests (PowerShell, BizTalk, Postman, SailPoint, C#, etc.).

Open

4. Save the Application and Retrieve the Client ID

After saving, the portal displays the Client ID. This value is required for:

• requesting the device code

• polling for the token

• refreshing tokens

It will look something like this:

Open

Record the Client ID and confirm the scopes assigned to the application.

5. Copy the ClientID into your application

• PowerShell

• Biztalk

• SailPoint

• C#

• …

PowerShell Example

A complete working PowerShell implementation is available here:

Device Code Flow PowerShell Example
Device Code Flow - PowerShell - GetPersonByIdentifier

This example demonstrates requesting the device code, polling for authorization, securely storing credentials, refreshing tokens, and calling the EliteID API with the resulting access token.

How the Client ID and Scopes Are Used

Device Code Request

The application sends the Client ID and Scope to the device authorization endpoint:

POST /connect/device
client_id={ClientId}
scope={Scopes}

The response includes:

• device_code

• user_code

• verification_uri

• verification_uri_complete

The user completes authentication at the verification URL by logging in with Username and Passwod.

Token Polling

The application polls the token endpoint using the device code:

POST /connect/token
grant_type=urn:ietf:params:oauth:grant-type:device_code
client_id={ClientId}
device_code={device_code}

Once approved, the server returns:

• access_token

• refresh_token

• expires_in

Troubleshooting

Device code request fails

Verify the application has Device Authorization Grant enabled.

Token polling never completes

Confirm the user visited the verification URL and entered the user code.

invalid_scope errors

Ensure the scopes assigned in the application match the scopes requested by the script.

No refresh token returned

Include offline_access in the scope list.