The user enters the code in Yandex.OAuth

On some devices (such as TVs), entering a confirmation code may be inconvenient. In this case, you can ask the user to enter the code on the Device authorization page.

The token can be saved in the app and used for API requests until its lifetime expires. The token should be available only to your app, so we don't recommend saving it in browser cookies, open configuration files, and so on.

Requesting confirmation codes

The application must request confirmation codes using the HTTP POST method

POST /device/code
Host: oauth.yandex.com

client_id=<app ID>
[& device_id=<device ID>]
[& device_name=<device name>]
[& scope=<requested required rights>]

Response with confirmation codes

Yandex.OAuth returns the code for the user and the information for the token request:

HTTP 200 OK

Content-type: application/json

{
  "device_code": "3e2a5a5c0e02439aa78a23442721848c",
  "user_code": "h5nbcr6c",
  "verification_url": "https://oauth.yandex.ru/device",
  "interval": 5,
  "expires_in": 300
}

Entering the user code

The user should enter the code from the user_code property on the page at the URL from the verification_url property. If the code is entered correctly, Yandex.OAuth suggests allowing or denying access for the app.

Example of such a page:

Requesting a token with the device code

The app sends the device code as well as its ID and password in a POST request.

POST /token HTTP/1.1
Host: oauth.yandex.com
Content-type: application/x-www-form-urlencoded
Content-Length: <request body length>
[Authorization: Basic <encoded string client_id:client_secret>]

   grant_type=device_code
   code=<device code obtained with the previous request>
[& client_id=<app ID>]
[& client_secret=<app password>]

You can also send the app ID and password in the Authorization header by encoding the <client_id>:<client_secret> string with the Base64 method. If Yandex.OAuth receives the Authorization header, the client_id and client_secret parameters in the request body are ignored.

Response with OAuth token

Yandex.OAuth returns the OAuth token, refresh token, and their lifetime in JSON format:

200 OK
Content-type: application/json

{
  "token_type": "bearer",
  "access_token": "AQAAAACy1C6ZAAAAfa6vDLuItEy8pg-iIpnDxIs",
  "expires_in": 124234123534,
  "refresh_token": "1:GN686QVt0mmakDd9:A4pYuW9LGk0_UnlrMIWklkAuJkUWbq27loFekJVmSYrdfzdePBy7:A-2dHOmBxiXgajnD-kYOwQ",
  "scope": "login:info login:email login:avatar"
}

The lifetime of the refresh token is the same as the OAuth token lifetime.

If a token couldn't be issued, the response contains a description of the error:

{
  "error_description": "<error description>",
  "error": "<error code>"
}

Error codes:

• authorization_pending: The user didn't enter the confirmation code yet.
• bad_verification_code: The passed code parameter value isn't a 7-digit number.
• invalid_client: The app with the specified ID (the client_id parameter) wasn't found or is blocked. This code is also returned if the client_secret parameter passed an invalid app password.
• invalid_grant: Invalid or expired confirmation code.
• invalid_request: Invalid request format (one of the parameters isn't specified, specified twice, or isn't passed in the request body).
• invalid_scope: The app rights changed after the confirmation code was generated.
• unauthorized_client: The app was rejected during moderation or is awaiting moderation.
• unsupported_grant_type: Invalid grant_type parameter value.
• Basic auth required: The authorization type specified in the Authorization header is not Basic.
• Malformed Authorization header: The Authorization header isn't in <client_id>:<client_secret> format, or this string isn't Base64-encoded.