Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.

I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.

Seems a lot safer to me than using my login credentials on a potentially unsafe device.

Yes, this is how it could work, or it could display a code you type into your phone.