You might find some inspiration from duosecurity, who uses QR codes during their setup process. (Don't know if they're using them for auth, yet.)