Device-code login is an authentication flow that lets a user start signing in on one device and complete it on another by entering a short code. It is common on smart TVs, terminal-only devices, and other systems where typing a full password is awkward.
In cyber security, this flow matters because it can be abused in phishing and account-takeover attempts. An attacker may trick a victim into entering a code on a legitimate sign-in page while the attacker controls the session being authorized, turning the user into the last step of the attack. Defenders reduce this risk with clear device and context prompts, code expiry, conditional access, phishing-resistant MFA, and user training that treats unexpected sign-in requests as suspicious.