Skip to main content

Non-Textual Verification URI Optimization

When "verification_uri_complete" is included in the authorization response (Section 3.2), clients MAY present this URI in a non-textual manner using any method that results in the browser being opened with the URI, such as with QR (Quick Response) codes or NFC (Near Field Communication), to save the user from typing the URI.

For usability reasons, it is RECOMMENDED for clients to still display the textual verification URI ("verification_uri") for users who are not able to use such a shortcut. Clients MUST still display the "user_code", as the authorization server will require the user to confirm it to disambiguate devices or as remote phishing mitigation (see Section 5.4).

If the user starts the user interaction by navigating to "verification_uri_complete", then the user interaction described in Section 3.3 is still followed, with the optimization that the user does not need to type in the "user_code". The server SHOULD display the "user_code" to the user and ask them to verify that it matches the "user_code" being displayed on the device to confirm they are authorizing the correct device. As before, in addition to taking steps to confirm the identity of the device, the user should also be afforded the choice to approve or deny the authorization request.

+-------------------------------------------------+
|                                                 |
|  Scan the QR code or, using     +------------+ |
|  a browser on another device,   |[_]..  . [_]| |
|  visit:                         | .  ..   . .| |
|  https://example.com/device     | . .  . ....| |
|                                 |.   . . .   | |
|  And enter the code:            |[_]. ... .  | |
|  WDJB-MJHT                      +------------+ |
|                                                 |
+-------------------------------------------------+

Figure 3: Example User Instruction with QR Code Representation
                of the Complete Verification URI
+-------------------------------------------------+
|                                                 |
|  https://example.com/device    | .  ..   . .| |
|                                | . .  . ....| |
|  WDJB-MJHT                     |[_]. ... .  | |
|                                +------------+ |
|                                                 |
+-------------------------------------------------+

+-------------------------------------------------+
|                                                 |
|  QRコードをスキャンするか、     +------------+ |
|  https://example.com/device    | . .  . ....| |
|                                |.   . . .   | |
|  WDJB-MJHT                     +------------+ |
|                                                 |
+-------------------------------------------------+