Cross-origin token redemption is permitted only for the 'Single-Page Application'

Question

I have been trying all day to get a minecraft plugin to allow players on bedrock edition on my geyser sever to (OPTIONALY) sign in to java edition using OAuth2's device code flow. I successfully can get a code and url but when I go to poll the API for a successful login I get "Cross-origin token redemption is permitted only for the 'Single-Page Application'." I've tried adding SPA to my azure app registration but the issue persists. I've tried setting the origin header in my request to "http://localhost" and the issue persist: here is my code for retrieving the login token:

public static JSONObject pollSignIn(String deviceCode) {
        double i = 0;
        long previousTime = 0;

        while (i <= 60000 /*GeyserFloodgateSkinFix.defaultConfig.requestTimeout*/) {
            while (!(System.currentTimeMillis() > previousTime)) {}
            previousTime = System.currentTimeMillis();
            i++;

            if ((i/1000) % 3 == 0) {
                try {
                    URL url = new URL("https://login.microsoftonline.com/common/oauth2/v2.0/token");
                    HttpURLConnection con = (HttpURLConnection) url.openConnection();
                    con.setRequestMethod("POST");
                    con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
                    con.setRequestProperty("Origin", null);
                    con.setDoOutput(true);
                    System.out.println(deviceCode);

                    String body = String.format(
                            "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=%s&device_code=%s",
                            "[Censored]",
                            deviceCode
                    );

                    byte[] output = body.getBytes(StandardCharsets.UTF_8);
                    OutputStream os = con.getOutputStream();
                    os.write(output);

                    BufferedReader br = new BufferedReader(new InputStreamReader(con.getInputStream()));
                    StringBuilder sb = new StringBuilder();
                    String line;
                    while ((line = br.readLine()) != null) {
                        sb.append(br.readLine());
                    }

                    JSONObject json = new JSONObject(sb.toString());

                    if (json.getString("token_type").equalsIgnoreCase("Bearer")) {
                        return json;
                    }
                }
                catch (Exception ignored) {
                    System.out.println(ignored.getMessage());
                }
            }
        }
        return null;
    }

if it helps heres the code I use to get the token (This works)

public static JSONObject getAuthCode() {
        try {
            URL url = new URL("https://login.microsoftonline.com/common/oauth2/v2.0/devicecode");
            HttpURLConnection con = (HttpURLConnection) url.openConnection();

            con.setRequestMethod("POST");
            con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
            con.setDoOutput(true);

            String body = String.format(
                    "scope=XboxLive.signin%%20offline_access&client_id=%s",
                    "[Censored]"
            );

            OutputStream os = con.getOutputStream();
            byte[] output = body.getBytes(StandardCharsets.UTF_8);
            os.write(output, 0, output.length);

            BufferedReader br = new BufferedReader(new InputStreamReader(con.getInputStream()));
            StringBuilder sb = new StringBuilder();
            String line;

            while ((line = br.readLine()) != null) {
                sb.append(line);
            }

            con.disconnect();
            return new JSONObject(sb.toString());


        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

UPDATE: I managed to fix the above error but now I am getting "The provided value for the input parameter 'scope' is not valid. The scope 'XboxLive.signin offline_access' is not configured for this tenant." Chanfing the tenant to "consumer" throws "The provided value for the input parameter 'device_code' is not valid. Device codes supporting the personal Microsoft Account sign-in audience can only be used for v2 common or consumers tenants"