Device sign-in for apps: approve a code on the web, get a scoped token issue #67
closed: completed andymccall opened this · 0 comments
andymccall
The Android client (and oh, and any app) can only sign in with a pasted personal access token: the API accepts only tokens, and web login sets a cookie the API ignores. Add a device-code flow (RFC 8628 style): the app asks /api/v1/device/code for a user code and polls /api/v1/device/token; the user approves the code at /device on the web, signed in with password and 2FA, choosing the scopes; the app receives a scoped token. oh auth login can use it too. From the oxygenhub-android review, 2026-09-30.
The Android client (and oh, and any app) can only sign in with a pasted personal access token: the API accepts only tokens, and web login sets a cookie the API ignores. Add a device-code flow (RFC 8628 style): the app asks /api/v1/device/code for a user code and polls /api/v1/device/token; the user approves the code at /device on the web, signed in with password and 2FA, choosing the scopes; the app receives a scoped token. oh auth login can use it too. From the oxygenhub-android review, 2026-09-30.