// GLOSSARY

Device code flow (Device Authorization Grant)

An OAuth 2.0 flow (RFC 8628) designed for devices with limited keyboard or browser interaction, where the user approves a code on a separate device. It carries no attacker-owned link, so the do-not-click reflex never engages.