I mean, the device code grant was codified by the IETF in 2019[0]. That is no guarantee that it is 100% secure, but folks have spent time working to make it as

I mean, the device code grant was codified by the IETF in 2019[0]. That is no guarantee that it is 100% secure, but folks have spent time working to make it as safe as possible. There's also a Best Current Practice (BCP) doc[1] and if you have suggestions to improve the flow, they'd be welcomed. 0: https://datatracker.ietf.org/doc/html/rfc8628 https://datatracker.ietf.org/doc/html/rfc8628 1: https://datatracker.ietf.org/doc/draft-ietf-oauth-cross-device-security/ https://datatracker.ietf.org/doc/draft-ietf-oauth-cross-devi...