After a successful token exchange, a developer caches the authorization code to “renew” access later when the access token expires. What happens if that code is replayed at the token endpoint?
Select an answer to reveal the explanation.
Short Explanation
A used cloakroom ticket will not get you a second coat. Replaying the authorization code fails. When the access token expires, use a refresh token or run a new grant—don’t reuse the code.
Full Explanation
Authorization codes are short-lived and single-use. Replaying the same code at the token endpoint is rejected, typically as invalid_grant. Access-token expiry is a different problem solved with a refresh token or a new authorization—not by caching and reusing the code as if it were a long-lived credential.