Device authorization grant
The OAuth device authorization grant lets a user authorize a requesting client through a browser on another device while the client polls for the result.
Signing in on a television
A television displays a short code. You open the service’s verification page on your phone, enter the code, and authorize the television.
The browser handles your interaction, but the television is the client waiting for tokens.
The two codes have different jobs
The short user_code identifies the request you authorize. The client keeps a separate device_code and uses it to poll for tokens.
Tokens go to that client, not to the browser where you entered the code. Device-code phishing exploits the separation by convincing someone to authorize an attacker’s client. The verification website can be genuine even when the request is not trustworthy.
To investigate, check who started the request, which client was authorized, and whether tokens were issued. Then check API activity to see what access was used.
The token comparison follows what happens next: access tokens go to APIs, while refresh tokens return to the authorization server.