Finish with a token or a terminal error

A user code is not an access token, and an approval is not the token response.

• While the user has not finished authorizing, the token endpoint returns authorization_pending. The device waits before repeating; no access token is already delivered in that state (§3.5).
• If the user approves and the server validates the device token request, the token endpoint returns the OAuth §5.1 success response: access_token and token_type are REQUIRED. A refresh_token is OPTIONAL. Token lifetime expires_in is RECOMMENDED in that response and is distinct from the REQUIRED code lifetime in the earlier device response (§3.5; RFC6749§5.1).
• access_denied means the authorization request was denied. expired_token means device_code expired and the session concluded. Both stop polling. An expired session MAY lead to a new device authorization request, but the client SHOULD wait for user interaction rather than restart automatically (§3.5).
• If an error is neither authorization_pending nor slow_down, the client MUST stop polling and SHOULD react appropriately, for example showing an error. This includes unfamiliar error codes; it is a whitelist of continuing errors, not just a list of two known fatal errors (§3.5).
• Any success shown assumes correct server-side validation, client requirements and user authorization. This guide does not implement accounts, consent verification, token storage, scope enforcement or an OAuth server. A locally expired timer never manufactures a success response.