OAuth Invalid Grant Error

Authorization codes are single-use. You must get a new one for each token request.

// ❌ Error: reusing the same code
const code = "abc123"
await exchangeCode(code) // Works first time
await exchangeCode(code) // invalid_grant: already used

// ✅ Get a new authorization code each time
// Redirect user to authorization URL
const authUrl = `https://auth.example.com/authorize?
  response_type=code&
  client_id=${clientId}&
  redirect_uri=${redirectUri}&
  state=${state}`
// User authorizes, gets redirected back with a new code

Authorization codes are short-lived. Exchange them immediately.

app.get("/callback", async (req, res) => {
  const { code, state } = req.query
  
  // Exchange immediately — codes expire in ~10 minutes
  const tokenResponse = await fetch("https://auth.example.com/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: process.env.REDIRECT_URI,
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET,
      code_verifier: pkceVerifier, // For PKCE flow
    })
  })
})

Replace refresh tokens on each use to prevent replay attacks.

// When refreshing, expect a NEW refresh token in response
async function refreshAccessToken(refreshToken) {
  const res = await fetch("https://auth.example.com/token", {
    method: "POST",
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: refreshToken,
      client_id: process.env.CLIENT_ID,
    })
  })
  
  if (res.ok) {
    const { access_token, refresh_token: newRefreshToken } = await res.json()
    // Store the NEW refresh token
    await storage.set("refreshToken", newRefreshToken)
    return access_token
  }
}