面向邮件应用的 OAuth 2.1：Thunderbird、Outlook、设备和命令行

# 1. Request a device code
curl -s https://mail.example.com/oauth/device_authorization \
  -d client_id=nextxch-cli -d "scope=mail offline_access"
# -> {"device_code":"...","user_code":"BCDF-GHJK","verification_uri":"https://mail.example.com/oauth/device",...}

# 2. Open https://mail.example.com/oauth/device in a browser, sign in, confirm code BCDF-GHJK

# 3. Poll every 5 seconds until the token arrives (authorization_pending / slow_down)
curl -s https://mail.example.com/oauth/token -d client_id=nextxch-cli \
  -d grant_type=urn:ietf:params:oauth:grant-type:device_code -d device_code=...

# 4. IMAP with the access token
curl -v --login-options AUTH=XOAUTH2 --oauth2-bearer "$ACCESS_TOKEN" \
  -u anna@example.com imaps://mail.example.com/INBOX

# 5. Refresh (the old refresh token becomes invalid) and revoke
curl -s https://mail.example.com/oauth/token -d client_id=nextxch-cli \
  -d grant_type=refresh_token -d refresh_token=nxrt_...
curl -s https://mail.example.com/oauth/revoke -d client_id=nextxch-cli -d token=nxrt_...