# Device Authorization Flow for a Rust CLI and an Axum API

[Auth0](https://yomu.fyi/company/auth0) · Aniket Bhattacharyea · Aug 18, 2026

**Type:** Tutorial

## Summary

Command-line tools lack browser redirect capabilities, preventing standard OAuth login flows. To resolve this limitation, the OAuth 2.0 Device Authorization Flow issues a temporary device code, presents a verification URL to the user, and waits for authentication in an external browser. A Rust workspace demonstrates this end-to-end pattern across a CLI, an Axum web API, and a shared authentication library. The shared library relies on jsonwebtoken and reqwest to fetch JSON Web Key Sets and validate token signatures, issuers, and audiences against typed claims. Axum secures protected routes through custom FromRequestParts extractors that decode Bearer headers, enabling verified CLI access.

## Context

CLI applications lack an embedded browser or redirect URL to execute standard OAuth login flows, and desktop or CLI tools cannot securely store a client secret.

## Approach / What changed

Implement the OAuth 2.0 Device Authorization Flow using Auth0 across a multi-crate Rust workspace comprising a CLI client, an Axum API, and a shared authentication library that fetches JWKS public keys and validates JWT tokens with strongly typed deserialization.

## Takeaways

- Auth0 disables the Device Authorization grant type by default on Native Applications, causing token polling to fail with an unauthorized\_client error if not explicitly enabled.
- The shared Rust library validates RS256 JWT tokens by parsing the key ID from the header, retrieving matching public keys from Auth0's JWKS endpoint, and enforcing audience and issuer checks.
- Axum route protection is implemented via the FromRequestParts trait, which extracts Bearer tokens from authorization headers and returns UNAUTHORIZED errors when validation fails.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [REST APIs](https://yomu.fyi/topic/rest-api), [Rust](https://yomu.fyi/topic/rust)

[Read original post](https://auth0.com/blog/device-authorization-flow-rust-cli-axum-api)