X_OAUTH_DENIED
Means
the user or the provider declined the authorization
Typical cause
error= on the callback redirect — nearly always the consent screen's Cancel. Split out of X_OAUTH_EXCHANGE_FAILED so the commonest non-success outcome of a login stops paging on-call as a 502 provider outage
Fix
restart at GET /auth/sso/<provider> and approve the consent screen; nothing is wrong with the app