From 21a01e9412d84a0f6042b2c549647bd32a81ef90 Mon Sep 17 00:00:00 2001
From: Elias Kohout <elias@kohout.de>
Date: Tue, 14 Apr 2026 00:48:16 +0200
Subject: [PATCH] fix: include client_secret in device authorization request

---
 src/serve/auth.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/serve/auth.go b/src/serve/auth.go
index 9575c8b..2391211 100644
--- a/src/serve/auth.go
+++ b/src/serve/auth.go
@@ -173,7 +173,9 @@ func (h *authHandler) deviceStart(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	da, err := h.oauth2.DeviceAuth(r.Context())
+	da, err := h.oauth2.DeviceAuth(r.Context(),
+		oauth2.SetAuthURLParam("client_secret", h.cfg.ClientSecret),
+	)
 	if err != nil {
 		writeError(w, http.StatusBadGateway, "device authorization request failed: "+err.Error())
 		return