Device Authorization Flow for a Rust CLI and an Axum API

Summary

Command-line tools lack browser redirect capabilities, preventing standard OAuth login flows. To resolve this limitation, the OAuth 2.0 Device Authorization Flow issues a temporary device code, presents a verification URL to the user, and waits for authentication in an external browser. A Rust workspace demonstrates this end-to-end pattern across a CLI, an Axum web API, and a shared authentication library. The shared library relies on jsonwebtoken and reqwest to fetch JSON Web Key Sets and validate token signatures, issuers, and audiences against typed claims. Axum secures protected routes through custom FromRequestParts extractors that decode Bearer headers, enabling verified CLI access.

Context

CLI applications lack an embedded browser or redirect URL to execute standard OAuth login flows, and desktop or CLI tools cannot securely store a client secret.

Approach / What changed

Implement the OAuth 2.0 Device Authorization Flow using Auth0 across a multi-crate Rust workspace comprising a CLI client, an Axum API, and a shared authentication library that fetches JWKS public keys and validates JWT tokens with strongly typed deserialization.

Takeaways

• Auth0 disables the Device Authorization grant type by default on Native Applications, causing token polling to fail with an unauthorized_client error if not explicitly enabled.
• The shared Rust library validates RS256 JWT tokens by parsing the key ID from the header, retrieving matching public keys from Auth0's JWKS endpoint, and enforcing audience and issuer checks.
• Axum route protection is implemented via the FromRequestParts trait, which extracts Bearer tokens from authorization headers and returns UNAUTHORIZED errors when validation fails.

Related reading

• Auth0 · Aug 25, 2026

  Whatever You Are Building, Auth0 Has a Plan

  Authentication and identity requirements vary substantially as software organizations scale from solo builders to multi-brand enterprises. Building and maintaining authentication in-house frequently consumes valuable engineering cycles and incurs ongoing costs associated with security patching and edge cases. To address these distinct development stages, Auth0 structures its platform across Free, Essentials, Professional, and Enterprise tiers with differentiated B2C and B2B pricing. Early-stage and growing teams gain access to enterprise connections, SCIM user synchronization, and multi-tenant routing through Auth0 Organizations. Larger customer deployments utilize features like multi-app Single Sign-On and passwordless logins, which have driven reported outcomes such as a 20% conversion lift and a 66% reduction in identity management time.

  Ruhma Khawaja

• Auth0 · Aug 20, 2026

  Enterprise-Managed Authorization for your MCP server: Setting Up and Testing XAA in Auth0