Stream Mobile App - Feature #70965: Login to the app with QR code

Jan Sandbrink
2026-01-22T14:47:29Z

Oh, you created a feature for this 😅

I think you already described it well. Let me add The Security Perspective™:

Adding a QR code to the login page (or anywhere) that doesn't do more than filling out the instance URL is not a security issue at all. Here it should just be clear what the purpose of the QR code is, because all kinds of login flows utilize QR codes in all kinds of directions these days.

On the other hand providing a QR code that can log you in immediately is much more convenient, but also has security implications attached. I am pretty sure that there are standards and best practices for this (which I didn't look up yet), but essentially what you want to prevent is that someone sitting behind you can use these QR codes to sneak into your account. So things that I'd see here are:

Only show the code on demand, not (for example) always when opening the My Account page

Require confirmation on the device that showed the code after scanning it

Probably only take it as a first factor and still require a second factor on the mobile device afterwards

It's a pretty huge topic to be honest and to some degree questionable whether it's worth all the effort. If we plan to go that route, we need to check which standards cover us here.