I’m building Native SSO between two apps on a device with no browser.
Signing in with the Device Authorization grant works, but when I add
the device_sso scope to the /device/authorize request, Okta returns:
invalid_scope - “The following scopes are not allowed for this request: [device_sso]”.
Without device_sso, no device secret is returned, so a second app can’t
use the token exchange.
Is there a supported way to obtain a device secret on a device that
cannot open a browser (for example a console or kiosk)? Or is Native SSO
only supported when the first sign-in uses the authorization code flow?