Device Authorization Flow 101: Logging in From Input Constrained Devices

on YouTube ↗30m

" summary

Explains device authorization flow by actually building a Micropython badge (Badge 2040) game that posts high scores: device requests a device code and user code, renders a QR, polls the authorization server every ~5 seconds, then receives JWT ID and access tokens. Back end is a FastAPI leaderboard that validates tokens from out Zero, saves scores to a JSON database, and updates the leaderboard. Demo shows the flow working end to end and the score upload succeeding.

AI-written summary · about

" chapters (10)

1. 0:00Device authorization flow intro
2. 2:07Input-constrained devices
3. 4:54Input issues solved
4. 8:52Demo of device flow
5. 13:07Coding device flow steps
6. 19:27User experience during auth
7. 23:53Leaderboard API backend
8. 25:38Live auth flow demo
9. 27:05Key takeaways
10. 28:32Q&A

" related talks

• 45mOAuth and beyond: Modern auth not only for the webFilip Koňařík, Dušan Jakub · GeeCON Prague 2023
• 35mKEYNOTE: Go with the FlowJessica Temporal · Python Web Conf 2023
• 29mSmartAuth: User-Centered Authorization for the Internet of ThingsBlase Ur, XiaoFeng Wang, Yuan Tian, Patrick Tague, Nan Zhang, Yueh-Hsun Lin, Xianzheng Guo · 26th USENIX Security Symposium (USENIX Security '17)
• 32mRemote device sign inTiffany Conroy · Codemotion Milan 2017
• 46mOpening Doors with JSON Web TokensBen Dechrai · NDC Sydney 2019
• 47mSwagbadge 101: Software and the Aiko frameworkAndy Gelme, Nicola Nye · Open Hardware Miniconf (LCA 2021)
• 20mIdentity providers, your app, and everything in-betweenHodaya Ankri · PyCon Israel 2022
• 23mRemote device sign-in – Authenticating without a keyboardTiffany Conroy · .concat() 2018