Device code sign-in, explained

The short answer

A device code is the short code a TV, console, streaming stick or other screen shows when it wants to sign in to your account. You type it, on the service's official address, on a phone or computer where you are already signed in. The service then hands the TV its own sign-in. Our beginner explainer, what is an activation code, covers the everyday view; this page goes one level deeper.

Where it comes from: an open standard

Most "enter a code" screens follow a published standard called the OAuth 2.0 Device Authorization Grant, written up by the Internet Engineering Task Force as RFC 8628 in August 2019. It was designed for devices that are connected to the internet but awkward to type on, such as smart TVs, media consoles and printers. Large identity providers document their own versions of it for developers, for example Google's guide to OAuth 2.0 for TV and limited-input device applications and Microsoft's page on the OAuth 2.0 device authorization grant. Individual streaming services do not always say which method they use, but the steps you see on screen match this pattern.

What happens, step by step

1. The device asks for codes. When you pick "sign in on another device", the TV app contacts the service and receives two codes: a long, secret device code it keeps to itself, and a short user code that it shows you, along with a short web address.
2. The device starts waiting. In the background it checks with the service every few seconds: "has my user approved yet?" The standard sets a default of five seconds between checks and tells the device to back off if the service says it is asking too often.
3. You approve on your phone. You open the address, sign in to the service as you normally would, and type the user code. A well-built page then tells you which device or app you are approving.
4. The device collects its sign-in. On its next check, the TV is told "approved" and receives its own access, without ever seeing your password.
5. Or it gives up. If you decline, or the code runs out of time, the device is told so and stops asking. You simply request a new code.

This is why the TV must stay on the code screen while you type, and why both steps need to happen within a few minutes.

Why the codes look the way they do

The standard gives services practical advice on the short code you type. It suggests using a small, case-insensitive set of letters without vowels, so codes cannot accidentally spell words, and avoiding characters that are easy to confuse, such as 0 and O or 1 and I. Its example code is eight letters split by a dash for readability; the dash is ignored when you type it. Because a short code is far easier to guess than a password, the standard also recommends that services limit how many codes can be tried and keep each code valid only for a limited time. That is the real reason your code "expired" if you took a coffee break. If yours keeps failing, our guide to activating a streaming app by code lists the usual fixes.

QR codes are the same thing

RFC 8628 also allows a "complete" address that already contains the user code. Apps often turn that address into a QR code: you scan it, the activation page opens with the code pre-filled, and you just confirm. The standard still asks the device to show the typed code and address as well, which is why you usually see both. See QR code activation, step by step.

The one real risk: device code phishing

The design has one weak spot, and the standard itself names it: a criminal can start a sign-in on their own device and then persuade you to type their code. If you do, you have approved their device, and they receive a working sign-in to your account without ever learning your password.

This is not theoretical. In February 2025 Microsoft's security team described a campaign, Storm-2372 device code phishing, in which attackers built rapport over messaging apps and then sent fake online meeting invitations whose "meeting ID" was really a device code. Victims typed it on a genuine sign-in page, which is what made the trick convincing.

The same rule covers streaming "activation support" scams. No legitimate service needs you to read a code aloud to a stranger, pay a fee, or install remote-access software to activate a TV. More red flags are listed in is it safe to enter an activation code?

If you think you approved the wrong device

1. Go to the service's official website yourself - type the address, do not use a link from a message.
2. Change your password and choose the option to sign out of other devices if it is offered.
3. Review the device list on your account and remove anything you do not recognise. Our guide to signing out of all devices shows where these pages live.
4. Turn on two-step verification if the service supports it.