RFC 8628 device authorization request
Start the device flow. Requires a pre-registered client_id (BCK.OAUTH.0016) and an agent_id (absent → BCK.OAUTH.0018). Returns the device_code the agent polls with and the user_code the human approves.
Body
Pre-registered connector (unregistered → BCK.OAUTH.0016).
"fleet"
Target agent — required today (absent → BCK.OAUTH.0018).
"agent-123"
RFC 8707 resource (audience) — SELECTS the credential. For the usual device-flow goal (an NVM API key), either omit it or use this API's host, as in the example; a NON-API resource makes the exchange mint an x402 permission instead, which fails with BCK.OAUTH.0008 if the binding has no delegation.
"https://api.nevermined.app"
"openid"
Response
Device + user codes
Machine secret the agent polls with (opaque).
"BCDF-GHJK"
"https://nevermined.app/oauth/device"
"https://nevermined.app/oauth/device?user_code=BCDF-GHJK"
600
Minimum seconds between token polls.
5