## TL;DR

ClickUp's OAUTH_016 on token exchange means the authorization code is bad: expired, already used, or issued for different client credentials. Get a fresh code and exchange it promptly with matching credentials.

## Error

```text
ClickUp API error: OAUTH_016 on token exchange
```

## Steps

1. Get a fresh authorization code (codes are single-use and short-lived) Expected: you have a valid code.
2. Exchange it immediately with the same client_id and client_secret Expected: credentials match the code.
3. Confirm the redirect URI matches the authorize request Expected: no mismatch.
4. Complete the exchange and store the tokens Expected: auth works.

## When to use

- OAUTH_016 on ClickUp token exchange
- The code is stale, reused, or mismatched

## When not to use

- The client secret is wrong (then fix the secret)
- The code was for a different app (then check the client id)

## Tool compatibility

- ClickUp OAuth
- Project tool integrations

## Variant phrasings

### clickup oauth_016

The authorization code is bad. Get a fresh one and exchange it promptly.

### clickup token exchange failed

Same: codes are single-use; check client credentials match.

## Why it happens

Agents retry the exchange with the same code, but codes are single-use. The second attempt always fails.

## Edge cases

- Exchange codes within seconds; some providers expire them in under a minute
- Store tokens, never the code

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uLbY6ZCHkjQeDjCGoFlRAA