From 68732e76cf52201be16edbee8d8576443f92153b Mon Sep 17 00:00:00 2001 From: Hugh Nimmo-Smith Date: Fri, 27 Feb 2026 10:46:41 +0000 Subject: [PATCH] Add context about use on desktop applications --- content/client-server-api/_index.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/content/client-server-api/_index.md b/content/client-server-api/_index.md index e00c8a43..e98734fc 100644 --- a/content/client-server-api/_index.md +++ b/content/client-server-api/_index.md @@ -1888,11 +1888,14 @@ endpoint to get the user ID that owns the access token. {{% added-in v="1.18" %}} -The device authorization flow allows clients on devices with limited input -capabilities (such as CLI applications or embedded devices) to obtain an -access token by having the user complete authorization on a separate device -with a web browser. This flow uses the [device authorization -grant](#device-authorization-grant). +The device authorization flow allows clients to obtain an access token without +needing to directly interact with a web browser. Instead, the user completes +authorization on a web browser that can be on a separate device. This is useful +for devices with limited input capabilities (such as CLI applications or +embedded devices) or where the redirect handling may be unreliable (such as a +desktop applications). + +This flow uses the [device authorization grant](#device-authorization-grant). In the context of the Matrix specification, this means requesting a [scope](#scope) including full client-server API read/write access and @@ -1967,9 +1970,12 @@ specific device characteristics and use case. For example: - An embedded device with a screen could encode the `verification_uri_complete` (with fallback to `verification_uri`) as a QR code for the user to scan with their phone. +- A desktop application running on a platform that does not support callbacks + could launch the `verification_uri_complete` (with fallback to + `verification_uri`) in the system browser. -The user opens the verification URI in a web browser on another device and -completes authentication and authorization. +The user opens the verification URI in a web browser, which may be on another +device, and completes authentication and authorization. **Token polling**