# typeform oauth authorization code reused error

## TL;DR
The code was already spent, usually by retry middleware or by both frontend and backend exchanging it. Find the double exchange in your logs, make the token call single-shot (exchange once, cache the result), then get a fresh code via a new authorize redirect and exchange it exactly once.

```text
typeform oauth authorization code reused error
```

## Use this when

- Typeform OAuth token exchange fails and logs show two token calls for one code
- The error appears when retries are enabled on the token call
- The flow works when retried manually with a fresh login

## Not for this skill when

- redirect_uri mismatch errors (register the URI)
- Refresh token failures months later (different flow)
- The authorize step itself failing (before any code exists)

## Steps

### Step 1: Find the double exchange

Search logs for the authorization code value and count token endpoint calls carrying it. Expected: you find two exchanges, revealing the retry path or dual caller.

### Step 2: Make the exchange single-shot

Remove retries on the token call for this error and cache the token result keyed by the code so a duplicate delivery cannot re-exchange. Expected: one code can only ever produce one token call.

### Step 3: Get a fresh code

Redirect the user through the Typeform authorize URL again. Expected: a new, unspent authorization code arrives.

### Step 4: Exchange once and store

Exchange the fresh code a single time and persist the tokens. Expected: the token endpoint returns success.

### Step 5: Add duplicate detection

Log every token call with the code fingerprint so future doubles are visible immediately. Expected: the next double exchange shows up as an alert, not a mystery.

## Tool compatibility

Typeform OAuth 2.0; authorization code grant; backend token exchange handlers.

## Variant phrasings

### Variant 1

typeform oauth code already used token exchange

### Variant 2

typeform authorization code expired exchanged twice

### Variant 3

oauth code reuse error typeform fix

## Why it happens

The OAuth specification makes authorization codes single-use for a reason: a code intercepted in transit should be worthless after its first legitimate exchange. Providers enforce this strictly, so the second exchange of the same code always fails. The double exchange is almost never malicious; it is plumbing. A frontend that exchanges the code and a backend that exchanges it again, retry middleware that replays the token POST, or a browser back-button resubmission all spend the code twice. Because the first exchange usually succeeds silently in a log nobody reads, teams debug the second failure as if the code were bad, when the code was fine and simply already used.

## Edge cases / pitfalls

- Browser back-button resubmits of the callback URL re-exchange the code; redirect after handling the callback.
- Load balancers can duplicate POSTs under failure; make the token handler idempotent.
- Some SDKs exchange the code automatically on callback AND expose a manual exchange; pick one path.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UqP-oyLUZ5tRG-d353Hcdw