(untitled)

The problem with the OAuth Device Authorization Grant is that you can initiate a request and send the URL to someone else and if they complete the login you get their token. With additional user friction you can mitigate this with a flow that reverses things (generate a unique login link, send that to the machine that completes the login, provide a code, require that that code be entered on the…