The handoff mechanism is itself a credential
Session handoff transfers an authenticated session from one device to another — scanning a code to continue on a phone what was started on a desktop, for instance — specifically so the user doesn't have to authenticate again on the new device. Whatever artifact makes this transfer possible, a code, a link, a short-lived token, functions as a credential in its own right, and deserves exactly the same scrutiny any other credential capable of granting a session would receive.
Treating the handoff mechanism as a minor implementation detail rather than as a genuine credential is where this pattern tends to go wrong — a handoff code that's long-lived, reusable, or easily guessable is a session hijacking opportunity wearing a convenience feature's clothing.
Designing the transfer to resist interception and replay
A well-designed handoff mechanism is valid only briefly, usable once, and bound closely enough to the specific transfer in progress that a captured copy can't be replayed later on a different device to reach a session it was never meant to access. This is the same underlying discipline session management generally requires, applied specifically to the moment a session moves between devices rather than to its ordinary, single-device lifetime.