feat(oauth): Implement OAuth 2.0 Device Authorization Flow (RFC 8628) #105675

dcramer · 2026-01-05T20:55:47Z

Summary

Adds support for the OAuth 2.0 Device Authorization Grant (RFC 8628), enabling headless clients (CLIs, CI/CD pipelines, Docker containers) to obtain OAuth tokens by having users authorize on a separate device with a browser.

Key Components

ApiDeviceCode model - Stores device authorization requests with secure device/user code generation
Device authorization endpoint (POST /oauth/device_authorization) - Returns device_code, user_code, and verification URLs
User verification pages (GET/POST /oauth/device) - Where users enter the code and approve/deny access
Token endpoint support - Added urn:ietf:params:oauth:grant-type:device_code grant type
Automatic cleanup - Expired device codes are cleaned up by the existing cleanup command

Flow

Device requests authorization via POST /oauth/device_authorization
Server returns device_code (secret) and user_code (human-readable like ABCD-EFGH)
Device displays user_code and verification_uri to user
Device polls POST /oauth/token with device_code
User visits verification URL, enters code, and approves/denies
On approval, device receives access token on next poll

Refs #99002
Refs getsentry/sentry-mcp#546

dcramer · 2026-01-05T20:56:37Z

Total cost:            $23.57
Total duration (API):  41m 4s
Total duration (wall): 3h 9m 11s
Total code changes:    2374 lines added, 168 lines removed
Usage by model:
        claude-haiku:  231.1k input, 12.7k output, 411.7k cache read, 104.8k cache write ($0.4669)
     claude-opus-4-5:  14.5k input, 120.7k output, 22.4m cache read, 1.4m cache write, 1 web search ($23.10)

github-actions · 2026-01-05T21:08:33Z

This PR has a migration; here is the generated SQL for src/sentry/migrations/1015_add_apidevicecode.py

for 1015_add_apidevicecode in sentry

--
-- Create model ApiDeviceCode
--
CREATE TABLE "sentry_apidevicecode" ("id" bigint NOT NULL PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY, "device_code" varchar(64) NOT NULL UNIQUE, "user_code" varchar(16) NOT NULL UNIQUE, "application_id" bigint NOT NULL, "user_id" bigint NULL, "organization_id" bigint NULL, "scope_list" text[] NOT NULL, "expires_at" timestamp with time zone NOT NULL, "status" varchar(20) NOT NULL, "date_added" timestamp with time zone NOT NULL);
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap" FOREIGN KEY ("application_id") REFERENCES "sentry_apiapplication" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap";
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_user" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id";
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_device_code_6d4da78d_like" ON "sentry_apidevicecode" ("device_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_code_90955a60_like" ON "sentry_apidevicecode" ("user_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_application_id_cf8361a8" ON "sentry_apidevicecode" ("application_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_id_ec448031" ON "sentry_apidevicecode" ("user_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_organization_id_c2717dcf" ON "sentry_apidevicecode" ("organization_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_expires_at_1f1b6c16" ON "sentry_apidevicecode" ("expires_at");

src/sentry/web/frontend/oauth_device.py

src/sentry/web/frontend/oauth_token.py

src/sentry/web/frontend/oauth_device.py

src/sentry/web/frontend/oauth_token.py

+                name="api_device_code",
+            )
+
+            with lock.acquire():


src/sentry/web/frontend/oauth_device.py

+        if scopes:
+            pending_scopes = set(scopes)
+            matched_sets = set()
+            for scope_set in settings.SENTRY_SCOPE_SETS:
+                for scope, description in scope_set:
+                    if scope_set in matched_sets and scope in pending_scopes:
+                        pending_scopes.remove(scope)
+                    elif scope in pending_scopes:
+                        permissions.append(description)
+                        matched_sets.add(scope_set)
+                        pending_scopes.remove(scope)


dcramer · 2026-01-05T23:37:51Z

Total cost:            $46.37
Total duration (API):  1h 13m 21s
Total duration (wall): 5h 47m 11s
Total code changes:    3011 lines added, 701 lines removed
Usage by model:
        claude-haiku:  328.8k input, 15.4k output, 411.7k cache read, 104.8k cache write ($0.58)
     claude-opus-4-5:  26.9k input, 210.9k output, 43.9m cache read, 2.9m cache write, 1 web search ($45.79)

actually this shows almost 6 hours, so i guess the cost includes the previous cost...

src/sentry/web/frontend/oauth_device.py

src/sentry/web/frontend/oauth_token.py

github-actions · 2026-01-07T23:22:19Z

This PR has a migration; here is the generated SQL for src/sentry/migrations/1016_add_apidevicecode.py

for 1016_add_apidevicecode in sentry

--
-- Create model ApiDeviceCode
--
CREATE TABLE "sentry_apidevicecode" ("id" bigint NOT NULL PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY, "device_code" varchar(64) NOT NULL UNIQUE, "user_code" varchar(16) NOT NULL UNIQUE, "application_id" bigint NOT NULL, "user_id" bigint NULL, "organization_id" bigint NULL, "scope_list" text[] NOT NULL, "expires_at" timestamp with time zone NOT NULL, "status" varchar(20) NOT NULL, "date_added" timestamp with time zone NOT NULL);
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap" FOREIGN KEY ("application_id") REFERENCES "sentry_apiapplication" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap";
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_user" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id";
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_device_code_6d4da78d_like" ON "sentry_apidevicecode" ("device_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_code_90955a60_like" ON "sentry_apidevicecode" ("user_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_application_id_cf8361a8" ON "sentry_apidevicecode" ("application_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_id_ec448031" ON "sentry_apidevicecode" ("user_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_organization_id_c2717dcf" ON "sentry_apidevicecode" ("organization_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_expires_at_1f1b6c16" ON "sentry_apidevicecode" ("expires_at");

BYK

Skipped the tests (for review) -- assuming you have tested the flow at least once everything looks sound.

I added some comments but none are major or critical IMO. 🚢

BYK · 2026-01-08T22:32:54Z

src/sentry/models/apidevicecode.py

+
+def generate_device_code():
+    """Generate a cryptographically secure device code (256-bit entropy)."""
+    return secrets.token_hex(nbytes=32)


Recommend moving the 32 into its own module-level constant like USER_CODE_LENGTH

BYK · 2026-01-08T22:35:06Z

src/sentry/models/apidevicecode.py

+    Reference: RFC 8628 §5.1
+    """
+    chars = [secrets.choice(USER_CODE_ALPHABET) for _ in range(USER_CODE_LENGTH)]
+    return f"{''.join(chars[:4])}-{''.join(chars[4:])}"


The splitting index 4 here is actually dependant on USER_CODE_LENGTH. We should pick either dividing USER_CODE_LENGTH by 2 or have a MAX_CHARS=4 constant where each char group consists of fixed-length (4 in this case) chars.

BYK · 2026-01-08T22:38:45Z

src/sentry/models/apidevicecode.py

+    # Device code: secret, high-entropy code used for token polling (RFC 8628 §3.2)
+    device_code = models.CharField(max_length=64, unique=True, default=generate_device_code)
+
+    # User code: human-readable code for user entry (RFC 8628 §3.2)
+    # Format: "XXXX-XXXX" using base-20 alphabet
+    # Must be unique since users look up by this code
+    user_code = models.CharField(max_length=16, unique=True, default=generate_user_code)


Some actual uniqueness needs we have:

device_code only needs to be unique in combination with the client id (guessing application below is that)

user_code only needs to be unique in combination with user

So these fields might be overly strict with their current definitions of uniqueness.

BYK · 2026-01-08T22:39:59Z

src/sentry/models/apidevicecode.py

+        db_table = "sentry_apidevicecode"
+
+    def __str__(self) -> str:
+        return f"device_code={self.id}, application={self.application.id}, status={self.status}"


Add user_code too?

BYK · 2026-01-08T22:42:08Z

src/sentry/runner/commands/cleanup.py

+    else:
+        debug_output("Removing expired values for ApiDeviceCode")
+        models_attempted.add(ApiDeviceCode.__name__.lower())
+        ApiDeviceCode.objects.filter(expires_at__lt=timezone.now()).delete()


Is there any value in "soft deletion" for auditing purposes?

i dont think we do that with grants either, so dont think we want to do it here. if it comes up we can add it later, but we have metrics and logs to some degree for abuse/diagnostics

BYK · 2026-01-08T22:52:34Z

src/sentry/web/frontend/oauth_token.py

+                # Re-check expiration inside lock (could have expired during lock wait)
+                if device_code.is_expired():
+                    device_code.delete()
+                    return self.error(
+                        request=request,
+                        name="expired_token",
+                        reason="device code expired",
+                    )


This feels a bit problematic as if I approved, and locking and refetching took a bit longer than it should, I may get a weird error?

BYK · 2026-01-08T22:54:12Z

src/sentry/web/frontend/oauth_device.py

+ERR_INVALID_CODE = "Invalid or expired code. Please check the code and try again."
+ERR_EXPIRED_CODE = "This code has expired. Please request a new code from your device."
+ERR_RATE_LIMITED = "Too many attempts. Please wait a minute and try again."
+ERR_NO_ORG_ACCESS = (
+    "This application requires organization-level access. "
+    "You must be a member of an organization to authorize this application."
+)
+ERR_SESSION_EXPIRED = "Your session has expired. Please start over."
+ERR_INVALID_REQUEST = "Invalid request. Please start over."
+ERR_INVALID_OP = "Invalid operation."
+ERR_SELECT_ORG = "Please select an organization."
+ERR_INVALID_ORG = "Invalid organization selection."
+ERR_NO_ORG_PERMISSION = "You don't have access to the selected organization."


None of these are translatable I guess? Do we care?

my understanding is we're likely to back out all localization in favor of future better solutions given we have done a poor job of maintaining it anyways, so yeah dont care atm

BYK · 2026-01-08T22:54:28Z

src/sentry/web/frontend/oauth_device.py

+    Handles case variations, missing dashes, and extra whitespace.
+    """
+    normalized = user_code.replace("-", "").upper().strip()
+    if len(normalized) == 8:


Those hard-coded 8 and 4 values again.

BYK · 2026-01-08T22:59:26Z

src/sentry/web/frontend/oauth_device.py

+        request.session[session_key] = {
+            "device_code_id": device_code.id,
+            "user_id": request.user.id,


If we index by user + user_code, do we still need to store device_code_id still?

BYK · 2026-01-08T23:02:40Z

src/sentry/web/frontend/oauth_device_authorization.py

+
+        # Build the verification URIs
+        verification_uri = absolute_uri("/oauth/device/")
+        verification_uri_complete = f"{verification_uri}?user_code={device_code.user_code}"


Dangerous URL construction?

Add support for the Device Authorization Grant, enabling headless clients (CLIs, CI/CD pipelines, containers) to obtain OAuth tokens by having users authorize on a separate device with a browser. Key components: - ApiDeviceCode model with secure device/user code generation - Device authorization endpoint (POST /oauth/device_authorization) - User verification pages (GET/POST /oauth/device) - Token endpoint support for device_code grant type - Automatic cleanup of expired device codes

Security improvements: - Add locking to device code token exchange to prevent race conditions - Key sessions by user_code to support multiple parallel authorizations and prevent multi-tab session overwrite attacks - Add TODO comment about similar issue in oauth_authorize.py Code refactoring: - Extract _error_response() helper to eliminate duplicate error patterns - Extract _get_validated_device_code() to centralize validation logic - Extract _handle_approve() and _handle_deny() for cleaner flow - Add _normalize_user_code() for consistent code formatting - Standardize error messages as module-level constants - Simplify post() method from ~180 lines to ~15 lines

The SetRemoteAddrFromForwardedFor middleware already handles X-Forwarded-For and sets REMOTE_ADDR correctly. This aligns with how the rest of the codebase handles client IP retrieval for rate limiting.

…roval Use filter().update() instead of save() to atomically mark device code as approved only if status is still PENDING. This prevents a TOCTOU race where two users entering the same user_code could both pass validation and race to set the user_id, with the last write winning.

- Use .id instead of _id FK attributes for mypy compatibility - Add UnableToAcquireLock exception handling in token exchange - Add type assertion for request.user.id in approval flow - Fix timedelta import in tests

Use the same atomic filter().update() pattern as approval to prevent race condition where denial could overwrite an already-approved device code, causing inconsistent state (ApiAuthorization exists but client receives access_denied).

Add ApiDeviceCode to the create_exhaustive_sentry_app method so that backup/export tests properly include the new model in scoping tests.

Add the new oauth/device/ and oauth/device_authorization/ routes to the controlsiloUrlPatterns.ts file to fix the test_no_missing_urls test.

Align with industry conventions (GitHub, Google) by using the shorter /oauth/device/code path instead of /oauth/device_authorization. - /oauth/device/code - device authorization endpoint (POST) - /oauth/device - user verification page (GET/POST)

Move the device code status check before authorization creation and wrap both operations in a transaction. This prevents orphaned authorizations if the device code update fails (e.g., due to race condition where another request already processed the device code). Previously, the authorization was created first, then the device code status was checked. If the status check failed, the authorization would persist even though no token could be issued.

Wrap token creation and device code deletion in a transaction to prevent duplicate tokens if delete fails after token creation. This follows the same pattern as grant_exchanger.py.

PostgreSQL aborts transactions on IntegrityError, preventing subsequent DB operations. Move try/except outside atomic block to allow the scope-merging code in the except block to run correctly.

Add expiration check after re-fetching device code inside the lock to prevent a race condition where a code could expire during lock wait.

Migration 1015 was taken by backfill_self_hosted_sentry_app_emails on master, so rename to 1016 and update dependencies.

- Extract magic numbers into named constants (DEVICE_CODE_BYTES, USER_CODE_GROUP_LENGTH) - Add user_code to ApiDeviceCode.__str__ for better debugging - Add "You can now close this tab" UX message to completion page - Use constants in _normalize_user_code instead of hardcoded values

github-actions · 2026-01-10T04:36:08Z

This PR has a migration; here is the generated SQL for src/sentry/migrations/1017_add_apidevicecode.py

for 1017_add_apidevicecode in sentry

--
-- Create model ApiDeviceCode
--
CREATE TABLE "sentry_apidevicecode" ("id" bigint NOT NULL PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY, "device_code" varchar(64) NOT NULL UNIQUE, "user_code" varchar(16) NOT NULL UNIQUE, "application_id" bigint NOT NULL, "user_id" bigint NULL, "organization_id" bigint NULL, "scope_list" text[] NOT NULL, "expires_at" timestamp with time zone NOT NULL, "status" varchar(20) NOT NULL, "date_added" timestamp with time zone NOT NULL);
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap" FOREIGN KEY ("application_id") REFERENCES "sentry_apiapplication" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_application_id_cf8361a8_fk_sentry_ap";
ALTER TABLE "sentry_apidevicecode" ADD CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_user" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_apidevicecode" VALIDATE CONSTRAINT "sentry_apidevicecode_user_id_ec448031_fk_auth_user_id";
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_device_code_6d4da78d_like" ON "sentry_apidevicecode" ("device_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_code_90955a60_like" ON "sentry_apidevicecode" ("user_code" varchar_pattern_ops);
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_application_id_cf8361a8" ON "sentry_apidevicecode" ("application_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_user_id_ec448031" ON "sentry_apidevicecode" ("user_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_organization_id_c2717dcf" ON "sentry_apidevicecode" ("organization_id");
CREATE INDEX CONCURRENTLY "sentry_apidevicecode_expires_at_1f1b6c16" ON "sentry_apidevicecode" ("expires_at");

Remove `# for type checker` and similar comments that aren't used elsewhere in the codebase. The assertions are self-explanatory.

cursor · 2026-01-10T06:18:23Z

src/sentry/models/apidevicecode.py

+                    )
+                continue
+
+        raise UserCodeCollisionError("Unable to generate unique device code")


Unreachable code after retry loop

Low Severity

The raise UserCodeCollisionError("Unable to generate unique device code") statement at line 214 is unreachable. The for loop on line 200 iterates through attempts 0 through 9. If create() succeeds, the function returns. If create() raises IntegrityError on the last attempt (when attempt == MAX_CODE_GENERATION_RETRIES - 1), the exception is raised inside the loop at line 209. There's no execution path that allows the loop to complete normally and reach line 214. This is dead code that could confuse future maintainers.

🔬 Verification Test

Why verification test was not possible: This is a static code analysis finding about unreachable code. The code path can be verified by logical analysis of the control flow:

MAX_CODE_GENERATION_RETRIES = 10 (line 56)

Loop iterates attempts 0-9 (line 200)

On success: return at line 202 (exits function)

On IntegrityError with attempt == 9: raise at line 209 (exits function)

On IntegrityError with attempt < 9: continue (next iteration)

No path exists that completes the loop normally. This can be confirmed by running a Python linter that detects unreachable code (e.g., pylint with "unreachable" check or examining the bytecode).

dcramer requested review from a team as code owners January 5, 2026 20:55

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jan 5, 2026

vercel bot deployed to Preview January 5, 2026 20:58 View deployment

dcramer force-pushed the oauth-device-flow branch from abc32ef to a25ea15 Compare January 5, 2026 21:00

vercel bot deployed to Preview January 5, 2026 21:03 View deployment

cursor bot reviewed Jan 5, 2026

View reviewed changes

src/sentry/web/frontend/oauth_device.py Outdated Show resolved Hide resolved

src/sentry/web/frontend/oauth_token.py Show resolved Hide resolved

vercel bot deployed to Preview January 5, 2026 22:24 View deployment

vercel bot deployed to Preview January 5, 2026 22:36 View deployment

cursor bot reviewed Jan 5, 2026

View reviewed changes

src/sentry/web/frontend/oauth_device.py Outdated Show resolved Hide resolved

vercel bot deployed to Preview January 5, 2026 22:58 View deployment

sentry bot reviewed Jan 5, 2026

View reviewed changes

src/sentry/web/frontend/oauth_token.py Outdated

name="api_device_code",

)

with lock.acquire():

This comment was marked as outdated.

Sign in to view

vercel bot deployed to Preview January 5, 2026 23:03 View deployment

cursor bot reviewed Jan 5, 2026

View reviewed changes

src/sentry/web/frontend/oauth_device.py Outdated Show resolved Hide resolved

sentry bot reviewed Jan 5, 2026

View reviewed changes

vercel bot deployed to Preview January 5, 2026 23:31 View deployment

vercel bot deployed to Preview January 5, 2026 23:57 View deployment

cursor bot reviewed Jan 6, 2026

View reviewed changes

src/sentry/web/frontend/oauth_device.py Show resolved Hide resolved

vercel bot deployed to Preview January 6, 2026 00:18 View deployment

vercel bot deployed to Preview January 6, 2026 00:21 View deployment

cursor bot reviewed Jan 6, 2026

View reviewed changes

src/sentry/web/frontend/oauth_device.py Outdated Show resolved Hide resolved

dcramer requested a review from a team as a code owner January 6, 2026 00:43

vercel bot deployed to Preview January 6, 2026 00:46 View deployment

cursor bot reviewed Jan 6, 2026

View reviewed changes

src/sentry/web/frontend/oauth_token.py Outdated Show resolved Hide resolved

github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Jan 6, 2026

vercel bot deployed to Preview January 6, 2026 22:15 View deployment

dcramer force-pushed the oauth-device-flow branch from 408d1d2 to 0267f8d Compare January 7, 2026 23:14

vercel bot deployed to Preview January 7, 2026 23:17 View deployment

BYK approved these changes Jan 8, 2026

View reviewed changes

dcramer added 19 commits January 9, 2026 20:27

chore(oauth): Remove i18n tags from device flow templates

40ca776

refactor(oauth): Remove _get_client_ip helper, use REMOTE_ADDR directly

8db11e9

The SetRemoteAddrFromForwardedFor middleware already handles X-Forwarded-For and sets REMOTE_ADDR correctly. This aligns with how the rest of the codebase handles client IP retrieval for rate limiting.

fix(oauth): Fix typing errors and handle UnableToAcquireLock

45a298b

- Use .id instead of _id FK attributes for mypy compatibility - Add UnableToAcquireLock exception handling in token exchange - Add type assertion for request.user.id in approval flow - Fix timedelta import in tests

fix(oauth): Add atomic status check to deny action

de2692d

Use the same atomic filter().update() pattern as approval to prevent race condition where denial could overwrite an already-approved device code, causing inconsistent state (ApiAuthorization exists but client receives access_denied).

Fix imports

7ce56ab

fix types

eea8152

Handle invalid scopes

f7016a1

fix(backup): Include ApiDeviceCode in exhaustive backup fixtures

0c7bf03

Add ApiDeviceCode to the create_exhaustive_sentry_app method so that backup/export tests properly include the new model in scoping tests.

fix: Add OAuth device flow URLs to control silo URL patterns

2745254

Add the new oauth/device/ and oauth/device_authorization/ routes to the controlsiloUrlPatterns.ts file to fix the test_no_missing_urls test.

fix(oauth): Wrap device code token exchange in transaction

f9ecf28

Wrap token creation and device code deletion in a transaction to prevent duplicate tokens if delete fails after token creation. This follows the same pattern as grant_exchanger.py.

fix(oauth): Move IntegrityError handler outside transaction block

85ea05b

PostgreSQL aborts transactions on IntegrityError, preventing subsequent DB operations. Move try/except outside atomic block to allow the scope-merging code in the except block to run correctly.

fix(oauth): Re-check device code expiration inside lock

25813cb

Add expiration check after re-fetching device code inside the lock to prevent a race condition where a code could expire during lock wait.

fix(migrations): Rename device code migration to 1016 after rebase

2585a55

Migration 1015 was taken by backfill_self_hosted_sentry_app_emails on master, so rename to 1016 and update dependencies.

dcramer force-pushed the oauth-device-flow branch from 2426197 to 836a149 Compare January 10, 2026 04:28

vercel bot deployed to Preview January 10, 2026 04:31 View deployment

chore: Remove unnecessary type checker comments

5e67f69

Remove `# for type checker` and similar comments that aren't used elsewhere in the codebase. The assertions are self-explanatory.

vercel bot deployed to Preview January 10, 2026 06:10 View deployment

cursor bot reviewed Jan 10, 2026

View reviewed changes

Uh oh!

feat(oauth): Implement OAuth 2.0 Device Authorization Flow (RFC 8628) #105675

Are you sure you want to change the base?

feat(oauth): Implement OAuth 2.0 Device Authorization Flow (RFC 8628) #105675

Uh oh!

Conversation

dcramer commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Components

Flow

Uh oh!

dcramer commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

dcramer commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

BYK left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BYK Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 10, 2026

Uh oh!

cursor bot Jan 10, 2026

Choose a reason for hiding this comment

Unreachable code after retry loop

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dcramer commented Jan 5, 2026 •

edited

Loading

dcramer commented Jan 5, 2026 •

edited

Loading

BYK Jan 8, 2026 •

edited

Loading