# authorization_pending

The user has not yet approved or denied the device authorization (RFC 8628 §3.5).

## Meaning

Sent by `/token` to a device polling with its `device_code` while the user has not yet
entered the code and decided on the `/device` screen.

## Impact

Normal protocol flow. The device keeps polling at its interval until the user decides
or the code expires after `expires_in` (900 seconds).

## Diagnosis

If a device never gets past it, find the flow's records by its `flow_id`:
`oauth.device.requested` when it started, `oauth.device.user_code.attempted` for codes
the user typed wrong, and `oauth.device.decided` once the user decided.

## Mitigation

- As a client developer: keep polling no faster than `interval`, and stop on
  `access_denied` or `expired_token`. See
  [the device grant](https://www.nauthera.io/docs/v1/integration#devices-and-clis-the-device-authorization-grant).
- As an operator: nothing to do.
- As a user: open the address the device shows, sign in, enter the code and approve.

## Escalation

If a device keeps receiving it after the user approved, open an issue with the request
id, the `flow_id` and the server version. Never attach the device or user code.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.