Sure. You could have QR code point to a URL on your server that started the oauth login process and had the one time hash value passed as a parameter. That hash

Sure. You could have QR code point to a URL on your server that started the oauth login process and had the one time hash value passed as a parameter. That hash value would be put in the callback URL for the oauth process. Once you complete your normal oauth login your server takes the one time hash value and does the same update the db trick done here. Aside: God, imagine if browser vendors had put a tiny bit of effort into password management or even just the UI around http auth back at the beginning. All sites could use http auth or whatever superceded it instead of their own login forms and this problem would seem just as stupid as it actually is.