access_denied
The user pressed Cancel on the consent screen. This arrives on
the redirect leg as
?error=access_denied&state=… — treat it as a
final answer, not a transient failure. Offer a retry affordance in your
UI rather than bouncing the user straight back to /authorize.