new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

device-authorization/configuration

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Pre-binding device code to user

When requesting a device code with user_id parameter, the code is bound to that user from the start. This skips the claiming step, and only the bound user can approve or deny it. Any other signed-in user receives an access_denied error. Pass user_id from trusted server-side code only.

Client validation in Device Authorization

validateClient option is a function that takes a clientId parameter and returns boolean or Promise<boolean>. Use it to check if a client is authorized before allowing device flow access.

Custom code generation in Device Authorization

Two configuration options for custom code generation: generateDeviceCode (custom function returning string or Promise<string> for device codes), generateUserCode (custom function returning string or Promise<string> for user codes). Default user code uses charset 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789' (excludes 0, O, 1, I to avoid confusion) with 8-character length.

onDeviceAuthRequest hook in Device Authorization

Hook called when device authorization is requested. Takes clientId (string) and optional scope (string) as parameters. Use it to log or audit device authorization requests.

Device Authorization security considerations

Security best practices: 1) Rate Limiting - plugin enforces polling intervals to prevent abuse. 2) Code Expiration - device and user codes expire after configured time (default 30 minutes). 3) Client Validation - always validate client IDs in production to prevent unauthorized access. 4) HTTPS Only - always use HTTPS in production for device authorization. 5) User Code Format - user codes use limited character set (excluding 0/O, 1/I) to reduce typing errors. 6) Authentication Required - users must be authenticated when calling GET /device; verification binds code to session and only that session can approve/deny. 7) Pre-binding - device codes issued with user_id skip claiming step and can only be approved/denied by that user; pass user_id from trusted server-side code only.

Give your agent this brain