# CLI Auth

CLI Auth for WorkOS Connect enables third-party applications to build command-line tools that integrate with your app's credentials using the [OAuth 2.0 Device Authorization Flow](https://datatracker.ietf.org/doc/html/rfc8628).

The CLI Auth flow for Connect involves two main endpoints:

1. The **device authorization URL** initiates the flow by obtaining device codes, user codes, and verification URIs.
2. The **device access token URL** is where the device exchanges the device code for access and refresh tokens after the user authenticates.

Read more about [CLI Auth here](/authkit/cli-auth/connect).

### device-code-grant

## Device code grant

Exchanges a device code for access and refresh tokens as part of the device authorization flow for WorkOS Connect applications. This endpoint should be polled repeatedly until the user authorizes the request, declines it, or the device code expires.



The returned tokens are similar to those provided by the [authorization code grant](/reference/workos-connect/token/authorization-code-grant).

### authorize-device

## Authorize device

Initiates the device authorization flow for WorkOS Connect applications. This endpoint implements the [OAuth 2.0 Device Authorization Flow](https://datatracker.ietf.org/doc/html/rfc8628) and is designed for CLI applications and other devices with limited input capabilities.

This endpoint is used by third-party applications to authenticate users through WorkOS Connect. Users will be prompted to authorize the application's access to their data as part of the consent flow.

### authorize

## Authorize

When authenticating a user for a WorkOS Connect application, this is the endpoint they should be redirected to. If they’re not already logged in, the user will be redirected to the AuthKit login page. For a third-party application, the user will have to authorize the application’s access on their first access.

### Widgets