The OAuth 2.0 device authorization grant flow is a login method for devices that cannot easily type credentials, such as smart TVs, CLI tools, or kiosks. The user starts sign-in on the limited device, receives a short code, and completes authorization on a separate browser or phone. The device then receives tokens that represent the user’s approved session.
In cybersecurity, this flow matters because it is legitimate but can be abused in phishing. An attacker can present a real device code request, trick a victim into approving it, and capture access tokens without stealing the password directly. That can lead to cloud account access, session persistence, or further abuse such as device enrollment. Defenders often treat device code flow as high risk, restricting or blocking it where possible, and monitoring for unusual sign-in, token, and device-registration activity.