Device Authorization Flow

Context My current goal is to develop a VR application using Supabase as the backend. I've already built a companion web/mobile application and now need a simple authentication method, since typing in VR is very tedious. Question Is it possible to implement a device authentication flow (something like the OAuth2 Device Code Flow/Device Authorization Grant) using Deno/Edge Functions? Expected Flow 1. The user sees a short authentication code displayed in the VR app. 2. On another device, the user (already authenticated on the web app) enters this code on a device-signin.html page. 3. The VR app automatically transitions to the logged-in state once authentication succeeds. Technical Challenge From what I can see, the main challenge is securely linking the web session with the device session — that is, authenticating a request received from the web app and then sending a valid Supabase access token (or similar credential) to the VR app for authenticated API …