Request two codes for different channels

A client identifier identifies the app; it is not a password.

• OAuth is a framework for delegated access. The device client is an app on a TV, printer or similar Internet-connected device with limited input or no suitable browser. The authorization server asks the user whether to allow access. RFC 8628 extends OAuth 2.0; it does not replace browser-based native-app authorization on capable phones (§1).
• The client SHOULD begin a device authorization request only when prompted by the user, rather than automatically on startup or after an earlier failure (§3.1). The device must already be able to make outbound HTTPS requests and communicate a URI and code; an inbound callback to the device is not required (§1).
• The client POSTs a UTF-8 application/x-www-form-urlencoded body to the device authorization endpoint. client_id is REQUIRED if the client is not authenticating; scope is OPTIONAL. Confidential clients authenticate under OAuth §3.2.1; public clients identify themselves with client_id. A distributed app identifier or embedded secret is not automatically confidential (§§3.1,5.6).
• All device requests MUST use TLS and implement BCP 195 best practices (§3.1). Parameters without a value MUST be treated as omitted; the server MUST ignore unrecognized request parameters; request and response parameters MUST NOT appear more than once. The separate device authorization endpoint is not the browser authorization endpoint or the token endpoint.
• A successful device response is HTTP 200 JSON with REQUIRED device_code, user_code, verification_uri and expires_in. verification_uri_complete and interval are OPTIONAL. expires_in is the lifetime in seconds of both codes; omitted interval defaults to five seconds, which clients MUST use (§3.2). The response is not an access token.
• After communicating user instructions, token requests go to the token endpoint with REQUIRED device_code and grant_type=urn:ietf:params:oauth:grant-type:device_code; client_id is REQUIRED when not authenticating. Clients issued credentials or other authentication requirements MUST authenticate (§3.4). The human user_code is not a substitute for device_code.