--- title: /oauth2/device/code description: The device flow endpoint as defined by RFC 8628. component: pingam version: 7.2 page_id: pingam:oauth2-guide:rest-api-oauth2-device-code canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oauth2/rest-api-oauth2-device-code.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md superseded_by: https://docs.pingidentity.com/pingam/8.1/am-oauth2/rest-api-oauth2-device-code.html --- # /oauth2/device/code The [device flow](oauth2-device-flow.html) endpoint as defined by [RFC 8628](https://www.rfc-editor.org/info/rfc8628). Client devices use this endpoint to present a user code to the resource owner that can be exchanged for an access token in the following flows: * Device flow ([OAuth 2.0](oauth2-device-flow.html)) * Device flow with PKCE ([OAuth 2.0](oauth2-device-flow-pkce.html)) You must compose the path to the device code endpoint addressing the specific realm where the user code will be issued. For example, `https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/device/code`. The device code endpoint supports the following parameters: * `client_id` Specifies the client ID unique to the application making the request. Required: Yes. * `state` Value to maintain state between the request and the callback. During authentication, the client sends this parameter to the authorization server. The authorization server must send it back unchanged in the response. The application should use this value to ensure the response belongs to the user that initiated the requests, which mitigates CSRF attacks. The value of `state` is typically a base64-encoded string that contains user state and that is unique to a user and their request. Required: No, but it is strongly recommended. * `scope` The scopes attached to the permissions requested from the resource owner by the client. If not specified, the default scopes specified in the client or the authorization server are requested. Required: No, providing default scopes are defined in the OAuth 2.0 client configuration. * `code_challenge` Specifies a string derived from the code verifier that is sent in the authorization request during the Device with PKCE flow. Required: Yes, when obtaining a user code in the Device with PKCE Flow. * `code_challenge_method` Contains the method used to derive the code challenge. Possible values are `plain` and `S256`. When unset, it defaults to `plain`. Required: Yes, when obtaining a user code in the Device with PKCE Flow. * `nonce` String value that associates the client session with the ID Token that also mitigates against replay attacks. Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `acr_values` Authentication Context class Reference values used to communicate acceptable authentication chains or trees. For more information, see [Add authentication requirements to ID tokens](../oidc1-guide/oidc-authentication-requirements.html). Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `prompt` A space-separated, case-sensitive list of ASCII values that specifies whether AM should prompt the end user for authentication and consent. Possible values are: * `none`. AM does not display authentication or consent pages. * `login`. AM prompts the end user to authenticate. * `consent`. AM prompts the end user to grant consent. Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `ui_locales` Specifies a space-separated list of the end user preferred languages for the user interface, ordered by preference. For example, `en fr-CA fr`. Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `login_hint` String value indicating the ID to use for login. When provided as part of the OpenID Connect Authentication Request, the `login_hint` is set as the value of a cookie named `oidcLoginHint`, which is an HttpOnly cookie (only sent over HTTPS). Authentication modules can then retrieve the cookie's value. For more information, see [GSMA Mobile Connect](../oidc1-guide/oidc-mobile-connect.html). Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `claims` Specifies a JSON object containing specific attributes about users to be returned in the ID Token. Required: No. [OpenID Connect flows](https://openid.net/specs/openid-connect-core-1_0.html) only. * `claim_token` Specifies an ID token containing the claims gathered during the UMA grant flow. Use together with the `claim_token_format` parameter. Required: No. [UMA Grant flow](https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html) only. * `claim_token_format` Specifies that the type of the token gathered during the UMA grant flow. AM only supports ID tokens as claim tokens. Use together with the `claim_token` parameter. Possible values are: * `https://openid.net/specs/openid-connect-core-1_0.html#IDToken` Required: No. [UMA grant flow](https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html) only.