Device Code Authentication

Some devices are poorly suited for typing. Entering a long password on a TV with a remote control takes forever and often goes wrong. Device Code Authentication solves this problem with a detour. The TV displays a short string of characters, for example BXQD-7RKM, along with a web address. You open this address on your phone or laptop and type in the string. There you sign in as usual, and shortly afterward the TV is also unlocked.

Why TVs and consoles need a detour

Without this method, devices without a keyboard would have to accept the password themselves. That’s bad for two reasons. First, entering it is cumbersome and error-prone. Second, the password would then end up on a device that you perhaps shouldn’t trust at all. A hotel TV or a borrowed console are not safe places for a Google or Netflix password.

With the device code procedure, the device never sees the password. In the end, it only receives a digital credential, a so-called token. With it, it may do exactly what it was authorized for, and nothing else. This token can later be revoked centrally without changing the password. Anyone who sells their old streaming device simply removes it from the account’s device list.

The procedure has also become important for software developers. Programs that run only in a text window cannot display a sign-in dialog. So they too print out a code and send the user to the browser. Many command-line tools from major cloud providers do exactly this.

What happens between the device and the authentication server

The process consists of four steps. First, the device registers with the service’s authentication server and requests a code. The server sends back two codes: a short one for the human and a long, secret one just for the device. The short one appears on the screen, the long one remains invisible inside the device.

In the second step, the user enters the short code on their phone and confirms the sign-in there. In parallel, the device keeps asking the server: Has approval arrived yet? This repeated querying is called polling, usually at intervals of a few seconds. As soon as confirmation is received, the server no longer replies with “still waiting” but with the token.

For security, the short code expires quickly, often after ten to fifteen minutes. It is also deliberately kept short and free of easily confused characters. But this is exactly where the best-known vulnerability lies. Fraudsters generate their own code and send it by email asking the recipient to confirm it quickly. Anyone who does so is, in reality, signing the attacker’s device into their own account. So the rule is: only enter a device code if it’s displayed on a screen right in front of you.

From Netflix to the cloud console

You most commonly encounter this procedure with streaming. Netflix, YouTube, Disney+, and Spotify use it to sign in smart TVs and consoles. Voice assistants and smart speakers also use it, since they have no screen at all and either read the code aloud or display it in the app. Technically, it’s almost always the same underlying standard, defined as the OAuth 2.0 Device Authorization Grant.

In the IT world, the term regularly appears in security advisories. Attacks using forged device codes have recently targeted corporate accounts on Microsoft 365. As a result, some companies disable the procedure entirely or allow it only for certain devices. Anyone reading such reports will, with this background, understand what’s at stake: not a cracked password, but a fraudulently obtained confirmation.