DeviceAuthorizationStore

Storage for RFC 8628 device authorizations.

interface DeviceAuthorizationStore

Implement this against whatever persistence an application already uses and bind it via the oauth.server.device_codes config key. Hazaar\OAuth\Store\DBI\DeviceAuthorizationStore provides a ready-to-use DBI-backed implementation.

The device code is a bearer secret: implementations must never persist it in plaintext — hash it (e.g. hash('sha256', ...)) before storage and compare hashes on lookup, as Hazaar\OAuth\Interface\RefreshTokenStore implementations do. The user code is short-lived and shown to the user, and is stored as-is.

Methods

__construct

Construct the store.

public __construct(array $config): void

Parameters

Parameter	Type	Description
$config	array

save

Persists a newly-minted device authorization.

public save(DeviceAuthorization $authorization): void

Returns: void

Parameters

Parameter	Type	Description
$authorization	Hazaar\OAuth\DeviceAuthorization

update

Persists a change to an existing authorization (its status, approving user, granted scope,

public update(DeviceAuthorization $authorization): void

Returns: void

poll time or interval), identified by its user code -- an authorization looked up by Hazaar\OAuth\Interface\DeviceAuthorizationStore::findByUserCode need not carry the plaintext device code.

Parameters

Parameter	Type	Description
$authorization	Hazaar\OAuth\DeviceAuthorization

findByDeviceCode

public findByDeviceCode(string $deviceCode): ?DeviceAuthorization

Returns: Hazaar\OAuth\DeviceAuthorization

Parameters

Parameter	Type	Description
$deviceCode	string

findByUserCode

Looks up an authorization by its user code. The returned object's deviceCode may be a

public findByUserCode(string $userCode): ?DeviceAuthorization

Returns: Hazaar\OAuth\DeviceAuthorization

stand-in (e.g. the stored hash) rather than the plaintext device code.

Parameters

Parameter	Type	Description
$userCode	string

consume

Atomically retrieves and removes an authorization the user has already decided on (approved

public consume(string $deviceCode): ?DeviceAuthorization

Returns: Hazaar\OAuth\DeviceAuthorization

or denied), so its tokens can only ever be issued once.

Implementations must leave a still-pending authorization in place and return null for it.

Parameters

Parameter	Type	Description
$deviceCode	string

---

Generated by Hazaar API Doc Generator on Thu, 22 Oct 2026 05:05:28 +0000