Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-01 17:24:10 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Add context about use on desktop applications

Browse source
This commit is contained in:
Hugh Nimmo-Smith 2026-02-27 10:46:41 +00:00
parent 9c94ec9f4a
commit 68732e76cf
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
content/client-server-api/_index.md
View file

@ -1888,11 +1888,14 @@ endpoint to get the user ID that owns the access token.
{{% added-in v="1.18" %}} {{% added-in v="1.18" %}}
The device authorization flow allows clients on devices with limited input The device authorization flow allows clients to obtain an access token without
capabilities (such as CLI applications or embedded devices) to obtain an needing to directly interact with a web browser. Instead, the user completes
access token by having the user complete authorization on a separate device authorization on a web browser that can be on a separate device. This is useful
with a web browser. This flow uses the [device authorization for devices with limited input capabilities (such as CLI applications or
grant](#device-authorization-grant). embedded devices) or where the redirect handling may be unreliable (such as a
desktop applications).
This flow uses the [device authorization grant](#device-authorization-grant).
In the context of the Matrix specification, this means requesting a In the context of the Matrix specification, this means requesting a
[scope](#scope) including full client-server API read/write access and [scope](#scope) including full client-server API read/write access and
@ -1967,9 +1970,12 @@ specific device characteristics and use case. For example:
- An embedded device with a screen could encode the `verification_uri_complete` - An embedded device with a screen could encode the `verification_uri_complete`
(with fallback to `verification_uri`) as a QR code for the user to scan with (with fallback to `verification_uri`) as a QR code for the user to scan with
their phone. their phone.
- A desktop application running on a platform that does not support callbacks
could launch the `verification_uri_complete` (with fallback to
`verification_uri`) in the system browser.
The user opens the verification URI in a web browser on another device and The user opens the verification URI in a web browser, which may be on another
completes authentication and authorization. device, and completes authentication and authorization.
**Token polling** **Token polling**