How do I authenticate with a GitHub app on behalf of a user using the device flow?

What I do (the docs):

1. Create an app (https://github.com/settings/apps)

   • GitHub App name: some-unique-name
   • Homepage URL: https://example.com (yeah, example.com, because I only need access to GitHub API from CLI, any better ideas?)
   • check Enable Device Flow
   • uncheck Active in the Webhooks section
   • repository permissions: Administration: read and write (which also adds Metadata: read-only)

2. Log in

   $ curl -X POST \
   -H 'Accept: application/json' \
   'https://github.com/login/device/code?client_id=...'
   {"device_code":"...","user_code":"...","verification_uri":"https://github.com/login/device",...}
   
   // authorize the app at https://github.com/login/device
   
   $ curl -X POST \
   -H 'Accept: application/json' \
   'https://github.com/login/oauth/access_token?client_id=...&device_code=...&grant_type=urn:ietf:params:oauth:grant-type:device_code'
   {"access_token":"...", ...}
   

3. Make a request

   $ curl -L -H 'Accept: application/vnd.github+json' \
   -H 'Authorization: Bearer ...' \
   -H 'X-GitHub-Api-Version: 2022-11-28' \
   https://api.github.com/repos/x-yuri/test-pub-repo/keys
   {"message": "Resource not accessible by integration",...}
   
   $ curl -L -H 'Accept: application/vnd.github+json' \
   -H 'Authorization: Bearer ...' \
   -H 'X-GitHub-Api-Version: 2022-11-28' \
   https://api.github.com/repos/x-yuri/test-private-repo/keys
   {"message": "Not Found", ...}
   

I'm using my personal account (GitHub Free).

What am I missing?

The missing part was installing the GitHub app. Installing an app gives the app the permissions specified when creating the app. And the resulting permissions are intersection of the user's (who authorizes the app) and app's permissions:

> Similarly, a user access token can only access resources that both the user and app can access. For example, if an app is granted access to repository A and B, and the user can access repository B and C, the user access token can access repository B but not A or C.

A howto can be found here.