Anonymous guest device token

A cloud network comprising:

• at least one processor;
• and
• at least one non-transitory computer-readable medium comprising program instructions that are executable by the at least one processor such that the cloud network is configured to:
• receive, at the cloud network, a cloud authorization grant assertion from a guest control device, wherein the cloud authorization grant assertion comprises at least a portion of a signed local-access token, wherein:
• the signed local-access token was generated in response to a self-signed authorization assertion sent from the guest control device to a first playback device on a local area network shared by the guest control device,
• the signed local-access token is signed by the first playback device and allows the guest control device to access services via playback devices on the local area network, and
• the at least the portion of the signed local-access token comprises an identifier for the first playback device;
• verify the signed local-access token is valid;
• and
• send, to the guest control device, a cloud guest token, wherein the cloud guest token is signed by the cloud network and allows the guest control device to access cloud-based services associated with the playback devices on the local area network.

A computer-implemented method for authenticating a guest control device, the computer-implemented method comprising:

• communicating, through a local area network to a media playback system comprising a first playback device, a self-signed authorization assertion;
• receiving, from the first playback device, a signed local-access token, wherein the signed local-access token is signed by the first playback device and allows the guest control device to access services via playback devices on the local area network;
• communicating, to a cloud network, a cloud authorization grant assertion, wherein the cloud authorization grant assertion comprises:
• at least a portion of the signed local-access token, wherein the at least the portion of the signed local-access token comprises an identifier for the first playback device;
• and
• receiving, from the cloud network, a cloud guest token, wherein the cloud guest token is signed by the cloud network and allows the guest control device to access cloud-based services associated with the playback devices on the local area network.