Poll a device login to token issuance (UC-091, RFC 8628). Anonymous. While the human has not signed in yet it answers {"status": "pending", "retry_after": <seconds>}: wait retry_after seconds and call again with the same challenge_id. On approval it returns Keycloak's token set (access_token, refresh_token, expires_in, ...) exactly once; pass the access_token as authorization ('Bearer ') to every other tool.