Signing in on smart TVs for a streaming service

Your company runs a video streaming service with 8 million subscribers. About half of all viewing happens in your app on smart TVs. Typing an email and a password with a TV remote is slow, and many people give up.

The product team has settled on a new flow. The TV shows a code of 8 random letters and a web address. The viewer opens the address on their phone, where they are usually signed in already, and types the code. Within a few seconds, the TV is signed in to their account. While the code is on screen, the TV app keeps a connection open to your server. If that connection drops, the TV shows a new code.

About 150,000 TVs sign in this way a day, up to 15 a second in the evening. A TV stays signed in for a year, unless the viewer removes it on their account page. A code works once, and only for 10 minutes. Nobody may end up signed in to another person's account by guessing a code.

What does the server store for each code, and what happens between a viewer typing it and the TV being signed in?