Device flow.
Auth for things that don't have a browser.

The flow agents are about to need

The next wave of clients hitting your APIs are not browsers and they are not native apps. They are CLIs, agents running on someone's laptop, and assistants running in someone else's product on the user's behalf. None of them can open a webview. All of them need the user to consent. Device flow is the standard answer: the client gets a code, the user visits a URL on their phone or laptop, types or scans the code, and grants access. The client polls until the consent lands. We ship it.

Three minutes from npm install to authorized

A CLI or agent calls createDeviceFlow, displays the URL + code to the user, and polls until the user completes consent. Tokens come out the same as any other OIDC flow.

// A CLI flow with @synqid/js — works in Node, Bun, Deno, any runtime
import { createSynqClient } from '@synqid/js'

const synq = await createSynqClient({
  issuer: 'https://api.synq.id',
  clientId: process.env.SYNQ_CLIENT_ID!,
})

const flow = await synq.createDeviceFlow({
  scope: 'openid profile offline_access',
})

console.log(`Open ${flow.verification_uri_complete}`)
console.log(`Or visit ${flow.verification_uri} and enter ${flow.user_code}`)

// Poll until the user completes the consent
const session = await flow.poll()
console.log('Signed in as', session.user.preferredUsername)

Get it live

Device flow only needs an App registration. There is no UI to wire.

1. 1

   Register an App with type Agent or Native

   In the Dashboard, create an App. Pick Agent for AI tooling or Native for a CLI. Both are public clients — Synq enforces PKCE on every device-flow exchange.
2. 2

   Allow the device_code grant

   Under Allowed grants, tick `urn:ietf:params:oauth:grant-type:device_code` (and `refresh_token` if you need long-lived sessions). Save.
3. 3

   Pick the scopes the agent is allowed to request

   Apps for agents typically request only what they need: `openid profile offline_access`. Brand-scoped custom scopes work too — useful when an agent must operate on specific resource families.
4. 4

   Drop the SDK into the CLI / agent

   @synqid/js exports createDeviceFlow which handles the discovery doc fetch, the device authorization request, and the polling loop. Just print the URL + code and await the session.
5. 5

   Audit-trail the agent in your backend

   Tokens issued via device flow include an `azp` claim identifying the client app. Surface it in your application logs and your audit log — useful when troubleshooting agent behavior or limiting per-agent rate.

How device flow / CLI auth compares

Most identity platforms either skip device flow or hide it behind enterprise SKUs. Synq ships it on every plan, marketed for the agentic era.

Pair it with

Common questions