Finish a login
Trade a sign-in for a key, returned once. A browser sign-in sends grant_type authorization_code with the code from the loopback redirect, its PKCE code_verifier and the same redirect_uri. A device login polls with device_code: authorization_pending (or slow_down) until someone authorizes it at /oauth/device. Errors: access_denied, expired_token, invalid_grant. No key needed. Does not use shortlist credits.
Body
authorization_code for a browser sign-in; omit (or device_code) to poll a device login.
authorization_code, device_code The rvca_ code the browser brought to redirect_uri.
The PKCE verifier whose S256 challenge opened /oauth/authorize.
The loopback address the code was sent to, exactly.
From POST /auth/device.