Twitter does something similar with 3rd-party authentication. The user puts in their name and password but then the rest of the process can be done by a bot. 1. click on a button to confirm granting access 2. provide the code in an image to he App but the HTML for the code hass the following:

<span id="code-desc">Next, return to TrainerLists and enter this PIN to complete the authorization process:</span>

<kbd aria-labelledby="code-desc"><code>7996044</code>