..which is a bad UX. Even worse than having to somehow copy the url and token to device (potentially giving them up to Apple\Google via email or some IM in the process of sending to one's self), since there's no way a human being can type all those chars