The user opens the URL on whatever device they want, not necessarily the box running the CLI. They log in, see the requested scopes and the client name, confirm the short code matches what the CLI printed, and approve.
link
CLI Authentication, the Right Way
ABGEO's Personal website
CLI Authentication, the Right Way
Most CLI auth flows spin up a localhost server and pray your browser cooperates. That model breaks the moment you're SSH'd into a server. RFC 8628 fixed this in 2019 and a lot of tools still haven't caught up.