# Local/agent development sign-in via the RFC 8628 device grant.
# Tokens minted for dev-console carry aud=[dev-console, https://otel.k6n.net], so the
# otel server (which requires aud to contain its own URL (OTEL_OIDC_AUDIENCE)) accepts them with no
# server-side change. Approval is still gated by the issuer's normal policy.
apiVersion: auth.k6n.net/v1alpha1
kind: AuthClient
metadata:
  name: dev-console
  namespace: ecommerce
  labels:
    auth.k6n.net/server: auth
spec:
  clientID: dev-console
  displayName: Dev console (device grant)
  description: Public dev client for local and agent development via the device grant
  redirectURIs: []
  audience:
    - https://otel.k6n.net
  scopes:
    - openid
    - profile
    - email
    - offline_access
---
# Partial apply: only deviceFlow is owned by this field manager.
apiVersion: auth.k6n.net/v1alpha1
kind: AuthServer
metadata:
  name: auth
  namespace: ecommerce
spec:
  deviceFlow:
    clientID: dev-console
    codeTTL: 10m
    pollInterval: 5s