Salesforce Certified Identity and Access Management Practice

The choice highlighting that the authorization server returns to the device an access token, a refresh token if requested, and other information is a crucial part of the OAuth 2.0 Device Authentication flow. In this flow, once the device has successfully been authenticated and authorized by the user, the authorization server provides the device with necessary tokens that enable it to make API calls on behalf of the user.

The access token is essential as it serves as a credential that proves the identity of the user during API requests. The refresh token, when requested, allows the device to obtain a new access token without requiring the user to re-enter their credentials, thus enhancing the user experience by providing seamless access even after the access token has expired. Additionally, other information returned can include details needed for managing the tokens or for session handling.

This step is pivotal in ensuring that the device can operate securely and efficiently, adhering to the principles of OAuth while providing the user with a smooth interaction with their data and applications.