Device Authorization Flow

[lufagovi]

Context

My current goal is to develop a VR application using Supabase as the backend.
I've already built a companion web/mobile application and now need a simple authentication method, since typing in VR is very tedious.

Question

Is it possible to implement a device authentication flow (something like the OAuth2 Device Code Flow/Device Authorization Grant) using Deno/Edge Functions?

Expected Flow

1. The user sees a short authentication code displayed in the VR app.
2. On another device, the user (already authenticated on the web app) enters this code on a device-signin.html page.
3. The VR app automatically transitions to the logged-in state once authentication succeeds.

Technical Challenge

From what I can see, the main challenge is securely linking the web session with the device session — that is, authenticating a request received from the web app and then sending a valid Supabase access token (or similar credential) to the VR app for authenticated API calls.

I’m also curious why this type of device authentication flow hasn’t been implemented yet as there so many ways to authenticate already ready to use.
It’s widely used in TV and console applications and would be equally suitable for VR headsets and other limited-input devices.
Thank you in advance for any guidance or suggestion