A device sign-in always shows the screen with the code to compare, even with stored consent or a pre-approved app (ID5.1)

Shipped: November 15, 2026 at 12:50 PM UTC
Author: Kamo
Commit: f5db1bd

RFC 8628 §5.4: comparing the code on the consent with the device's is the only defence against a code someone else started; a covered or PREAPPROVED request must not skip it.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing