This page is now a "device"

Think TV, CLI, or headless agent: no browser of its own. It asked the IdP for a device authorization (RFC 8628 §3.1) and got:

{
  "device_code": "(kept server-side — it is a credential)",
  "user_code": "KXTC-RRHV",
  "verification_uri": "https://id.knauth.in/dev/oauth/device",
  "verification_uri_complete": "https://id.knauth.in/dev/oauth/device?user_code=KXTC-RRHV",
  "expires_in": 600,
  "interval": 5
}

Step 1 — Show the human the code

The device displays KXTC-RRHV and asks you to visit the verification page — the SAME page any real device would send you to. Approve (or deny) there, then come back and poll.

Open the verification page

Step 2 — Poll the token endpoint

The device polls with its device_code every interval seconds. Each result below is a real token-endpoint answer:

Poll now

Polling before approval shows authorization_pending; hammering faster than the interval earns slow_down (§3.5).

Wire reference: curl -s -X POST https://id.knauth.in/dev/oauth/device_authorization -d client_id=dcr-5K3yfKABXPXPBaq-1K1O-VC5WiBpHxDTImxmbVp-EME -d 'scope=openid email'

kwiss — spec-faithful mock IdP. Everything here is synthetic and disposable: tenants auto-provision on first use, keys and credentials are runtime-minted throwaways. Tamper-evident, independently verifiable audit included. Not for production identities.