A code is generated by a primary cloud server and sent to a device to be controlled (controlee). The code is displayed and a user speaks the code to a controller device, such as a voice assistant (VA). The controller sends the spoken code via a third party server to the primary server and if the primary server identifies the code as being correct, a first step is complete. The controlee then generates a second code, sends it to the primary server and also displays it for a user to speak it to the controller, which sends the spoken second code to the primary server via the third party server. If the primary server identifies the second code as being correct, pairing is authorized between the controller and controlee. The first and second steps should be completed within a timeout period to be valid.