{"record":{"id":"5cd892e8d7d9573c","repo":"ory/hydra","slug":"user-code-is-required","errorCode":null,"errorMessage":"user_code is required","messagePattern":"user_code is required","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"cmd/cmd_perform_device_flow.go","lineNumber":180,"sourceCode":"\n\terr := userCodeTemplate.Execute(w, userCodeData{\n\t\tUserCode:        r.URL.Query().Get(\"user_code\"),\n\t\tDeviceChallenge: r.URL.Query().Get(\"device_challenge\"),\n\t})\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to render template: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n}\n\nfunc (s *deviceSrv) POSTdevice(w http.ResponseWriter, r *http.Request) {\n\tif err := r.ParseForm(); err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to parse form: %s\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\tuserCode, challenge := r.FormValue(\"user_code\"), r.FormValue(\"device_challenge\")\n\tif userCode == \"\" {\n\t\thttp.Error(w, \"user_code is required\", http.StatusBadRequest)\n\t\treturn\n\t}\n\tif challenge == \"\" {\n\t\thttp.Error(w, \"device_challenge is required\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\t// Accept the user code with a hand-rolled request instead of the generated\n\t// client: other modules in this repository compile this package against the\n\t// released hydra-client-go/v2 module, which predates the device\n\t// authorization API.\n\tcfg := s.cl.GetConfig()\n\tif len(cfg.Servers) == 0 {\n\t\thttp.Error(w, \"No Hydra endpoint is configured\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tacceptURL := strings.TrimSuffix(cfg.Servers[0].URL, \"/\") +\n\t\t\"/admin/oauth2/auth/requests/device/accept?device_challenge=\" + url.QueryEscape(challenge)","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/cmd/cmd_perform_device_flow.go#L162-L198","documentation":"Returned by POSTdevice when the submitted form contains an empty user_code field. The device-flow verification handler requires the user-visible code entered by the user; its absence means the form was submitted without it, independent of the device_challenge value.","triggerScenarios":"Submitting the device verification form with an empty user_code field, or a client omitting the user_code form key entirely.","commonSituations":"User leaving the code field blank and submitting; automation posting only device_challenge; form field name mismatch (e.g. 'code' instead of 'user_code').","solutions":["Include the user_code form field with the code displayed by the CLI/device flow","Check the form input's name attribute is exactly user_code","Prompt the user to re-enter the code if left blank","Use verification_uri_complete so the code is pre-filled"],"exampleFix":"// before\ncurl -X POST http://localhost:4445/device -d 'device_challenge=abc'\n// after\ncurl -X POST http://localhost:4445/device -d 'user_code=1234&device_challenge=abc'","handlingStrategy":"validation","validationCode":"// client side: check before submitting\nif not user_code:\n    raise ValueError(\"user_code is required before submitting the device form\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Require the user_code input with the HTML required attribute","Match field names exactly (user_code) in automation","Pre-fill via verification_uri_complete to avoid empty submissions","Validate inputs client-side before POSTing"],"tags":["http","device-flow","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}