Skip to content

python

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

python

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
.dockerignore
.dockerignore
 
 
Dockerfile
Dockerfile
 
 
README.md
README.md
 
 
device_flow.py
device_flow.py
 
 
requirements.in
requirements.in
 
 
requirements.txt
requirements.txt
 
 

README.md

Python Device Authorization Flow

Native/CLI Application (Public Client) using the Device Authorization Grant (RFC 8628).

No client secret is needed. The user authenticates by visiting a URL in their browser and entering a code.

Vouch application type: Native (public client — the only type authorized for the device authorization grant; a Web or SPA application is refused at /oauth/device with unauthorized_client).

Environment Variables

  • VOUCH_ISSUER - OIDC issuer URL (default: https://us.vouch.sh)
  • VOUCH_CLIENT_ID - The public client ID

Run with Docker

docker build -t vouch-python-device-flow .
docker run -it \
  -e VOUCH_ISSUER=https://us.vouch.sh \
  -e VOUCH_CLIENT_ID=your-client-id \
  vouch-python-device-flow

Advanced Features

  • UserInfo + profile enrichment — Fetches email from the UserInfo endpoint and reads hardware_verified, acr and amr from the access token after verifying it against JWKS
  • Post-auth API call — Makes a second UserInfo call to demonstrate using the access token for subsequent API requests