Implement the OAuth device authorization grant (RFC 8628)

Steps

1. POST to the device authorization endpoint (advertised as device_authorization_endpoint in discovery metadata) with client_id and scope to receive device_code, user_code, verification_uri, and optionally interval and expires_in.
2. Display the user_code and verification_uri (or verification_uri_complete if available) to the user on the device; the user visits the URI on a separate device to enter the code.
3. Begin polling the token endpoint with grant_type=urn:ietf:params:oauth:grant-type:device_code, client_id, and device_code; wait at least the number of seconds specified by the interval parameter (default 5 if not provided) between polls.
4. On authorization_pending response, continue polling; on slow_down response, increase your polling interval by 5 seconds and continue.
5. On a successful response, store the access token and refresh token; on an expired_token or access_denied response, cancel polling and prompt the user to restart.
6. Implement a total timeout based on the expires_in value from the device authorization response; stop polling after that duration regardless of status.