I have a django app that uses the Django REST Framework with the Django OAuth Toolkit and django-rest-framework-social-oauth2.

Each user has a raspberry pi that can come with a preloaded token. When users login to the website for the first time they are asked to enter the token that they got and is associated with the device. The device then should be tied to the user and is supposed to download configuration linked to the user profile.

I was thinking that I could create an oauth client_id/secret for each device, and only give the user the client_id, and tie the credentials to their account once they enter it. The device could then access an API endpoint and see user specific data.

Is there any way to do this? Any other suggestions to solve this problem would also be welcome!