A QR code flow is an authentication or registration process where a user scans a code to transfer session or relying party details between devices. In passwordless identity assurance, it often bridges web, desktop, and mobile steps so the user can complete biometric verification on a trusted device.
Expanded Definition
QR code flow is a cross-device authentication or registration pattern, not a standalone security control. Its purpose is to move context from one device to another so a user can complete a login, approve an action, or finish enrollment on a trusted endpoint after starting on a less convenient one.
In practice, the code usually encodes a short-lived request reference, a device pairing token, or a redirect to a trusted app or browser session. The term is sometimes used loosely across vendors, so boundaries matter: a QR code flow is about transferring session or relying party context, while the biometric check, passkey approval, or token issuance step is the actual assurance event. That distinction is important because a QR code can be part of both secure and weak designs.
For identity teams, the key question is whether the flow binds the scan to the intended user, device, and transaction, or whether it merely creates a convenient handoff with weak verification. The OWASP Non-Human Identity Top 10 is useful here because many QR-based flows eventually rely on machine- or session-bound credentials that must be treated as governed identity artifacts.
Examples and Use Cases
QR code flows appear in products and internal identity journeys when teams want to reduce typing, improve enrollment, or move a user from desktop to mobile without exposing a password.
- A desktop login page shows a QR code that the user scans in a mobile authenticator app to approve sign-in on the web session.
- A registration flow uses a QR code to connect a newly installed desktop client to an already verified mobile device.
- An enterprise support portal issues a short-lived QR code so a user can continue identity proofing on a smartphone after starting on a workstation.
- A device pairing workflow uses a QR scan to establish trust between a browser session and a companion app before issuing a passkey or token.
- A customer onboarding journey uses a QR code to reduce friction, but still requires the authoritative verification step to happen on a trusted device.
The tradeoff is convenience versus control. QR-based handoff can improve completion rates and reduce password exposure, but it also creates a temporary bridge between devices that must be tightly scoped, short-lived, and resistant to replay or interception.
Security Implications
QR code flows fail when teams assume the scan itself proves identity. A QR image is only a transport mechanism; if the underlying request is not bound to a specific transaction, device, or time window, an attacker can reuse it, redirect it, or trick a user into approving the wrong session.
Common failure conditions include session fixation, token replay, phishing by proxy, and weak device binding. A compromised or unattended device can also become the approval point for an otherwise strong flow, which means the assurance level is only as good as the trusted endpoint and the approval logic behind it.
NHIMG research shows that 79% of organisations have experienced secrets leaks, with 77% of those incidents resulting in tangible damage, which is relevant here because QR-enabled workflows often depend on short-lived tokens, device assertions, or backend secrets that must not be exposed or reused. The practical warning sign is a QR journey that works even when the scanned context is stale, over-broad, or separable from the intended user action.
Domain and Governance Relevance
QR code flow matters in identity governance because it changes where trust is established. Instead of authenticating entirely on one interface, the organisation is asking one device to initiate a request and another device to vouch for it, which creates a new control boundary around approval, device assurance, and session transfer.
For non-human identities, the relevance is usually indirect but real. The flow may deliver access to an application, agent, API session, or delegated credential path, so the governance question becomes whether the resulting machine or user session is traceable, revocable, and appropriately scoped. If a QR journey eventually provisions access for an automated workflow, then the downstream identity must be inventoried and governed like any other credential-bearing actor.
In mature programs, QR code flows are evaluated alongside session lifecycle, device trust, and credential handoff design rather than as a cosmetic UX feature. That keeps the conversation focused on who is being trusted, what context is being transferred, and how quickly the trust can be withdrawn when the flow is abused or no longer valid.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | QR flows often transfer short-lived tokens or device-bound credentials. |
| NHI-04 — Lifecycle and Offboarding | QR-driven enrollment can create new identities or sessions that must be revoked. | |
| NHI-06 — Visibility and Inventory | QR handoffs obscure which device or session owns the resulting access path. | |
| Recommendation — Bind QR-issued credentials to scope, time, and device before exchange. Track QR-created identities and revoke them when trust is withdrawn. Inventory QR-based session bridges and monitor them for anomalous use. | ||
| CIS Controls v8 | 5.1 — Establish and Maintain an Inventory of Enterprise Assets | QR flows span devices, so the trust boundary depends on known endpoints. |
| 6.3 — Require MFA for Externally-Exposed Applications | QR login is often used as an MFA or passwordless step for user access. | |
| Recommendation — Validate that only managed devices can complete QR-based authentication. Enforce strong second-factor approval before issuing access from QR flows. | ||
| NIST Zero Trust (SP 800-207) | 3.1 — Access Requests and Enforcement | QR flows are access requests that must be evaluated before session issuance. |
| Recommendation — Treat QR scans as access requests and enforce policy before token release. | ||
| MITRE ATT&CK | T1528 — Steal Application Access Token | Abuse of QR flows can expose or redirect session tokens and access grants. |
| Recommendation — Detect token theft and replay attempts around QR-based login paths. | ||
Related resources from NHI Mgmt Group
- What should teams do when a QR code leads to a suspicious login flow?
- How can organisations reduce QR-code phishing in AI-assisted browsing workflows?
- How should security teams implement the OAuth authorization code flow safely?
- How do you know if a device code flow is operating within its intended boundary?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
