In which OAuth2 grant would you find a user code?

The usercode is a key component of the OAuth 2.0 Device Authorization Grant, also known as the device flow. This flow is designed for devices with limited input capabilities, such as smart TVs or IoT devices. The device displays a usercode and a verification URI. The user then goes to a secondary device (e.g., a smartphone), navigates to the URI, authenticates, and enters the usercode to authorize the request.

A. The client credentials grant is for non-interactive, machine-to-machine communication and does not involve a user or a user code.

B. The authorization code grant uses a one-time code exchanged between the client and authorization server, but not a usercode for manual entry.

C. The resource owner password credentials grant directly uses the user's username and password, not a separate user code.

1. Internet Engineering Task Force (IETF), RFC 8628, "OAuth 2.0 Device Authorization Grant", Section 3.1 "Device Authorization Request" and Section 3.2 "Device Authorization Response". Section 3.2 specifies that the authorization server's response includes the usercode.

2. Ping Identity, Access Management Documentation, "OAuth 2.0 and OpenID Connect", Section: "OAuth 2.0 Device Authorization Grant". This documentation describes the flow and explicitly mentions the role of the usercode that is displayed to the end-user.