Receives the user's consent decision (approve or deny) from the consent page as a form POST.

CSRF is enforced by request provenance — Sec-Fetch-Site must be same-origin (with an Origin/Referer allow-list fallback); there is no separate CSRF token. On approval an authorization code is created and the browser is redirected to the client's redirect_uri; on denial it is redirected with error=access_denied.

This endpoint is submitted by the consent page, not called directly by clients.