# Native SSO on a device with no browser: how to get a device secret

**URL:** <https://devforum.okta.com/t/native-sso-on-a-device-with-no-browser-how-to-get-a-device-secret/35503>\
**Category:** OAuth/OIDC\
**Created:** [October 21, 2026, 1:57am UTC](https://devforum.okta.com/t/native-sso-on-a-device-with-no-browser-how-to-get-a-device-secret/35503 "2026-10-21T01:57:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanimolli](https://avatars.discourse-cdn.com/v4/letter/k/d26b3c/32.png) [@kanimolli](https://devforum.okta.com/u/kanimolli)\
**Post date:** [October 21, 2026, 1:57am UTC](https://devforum.okta.com/t/native-sso-on-a-device-with-no-browser-how-to-get-a-device-secret/35503/1 "2026-10-21T01:57:58Z")

</div>

I’m building Native SSO between two apps on a device with no browser.  
Signing in with the Device Authorization grant works, but when I add  
the device\_sso scope to the /device/authorize request, Okta returns:  
invalid\_scope - “The following scopes are not allowed for this request: [device\_sso]”.  
Without device\_sso, no device secret is returned, so a second app can’t  
use the token exchange.

Is there a supported way to obtain a device secret on a device that  
cannot open a browser (for example a console or kiosk)? Or is Native SSO  
only supported when the first sign-in uses the authorization code flow?