# Authorization code grant flow is returning invalid authorization code

**URL:** <https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136>\
**Category:** Questions\
**Created:** [September 14, 2021, 5:14pm UTC](https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136 "2021-09-14T17:14:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pradeepkumarl](https://avatars.discourse-cdn.com/v4/letter/p/65b543/32.png) [@pradeepkumarl](https://devforum.okta.com/u/pradeepkumarl)\
**Post date:** [September 14, 2021, 5:14pm UTC](https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136/1 "2021-09-14T17:14:51Z")

</div>

I have set up my client application with redirect URI and am able to generate the `authorization_code`

 ![auth_code](https://global.discourse-cdn.com/oktadev/original/2X/6/6fe72e9ddcbb6cc0aa26c3c49131f1c52c6cf43d.png)

When I take the auth code and try to fetch the token using Postman client I am getting “authorization code is invalid or has expired”. Please find the screenshot below

 ![error](https://global.discourse-cdn.com/oktadev/original/2X/f/fcec8a7cdf92317d201c6dd76c97f602c853a672.png)

Note: I am aware that the authorization code validity is 300 seconds and have used the valid auth code to generate the access token.

Note: I am using this reference link from the documentation to generate the access token - [Documentation-Link](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/#exchange-the-code-for-tokens)

Where am I going wrong?

---

<div class="post-metadata">

**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\
**Post date:** [September 14, 2021, 7:52pm UTC](https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136/2 "2021-09-14T19:52:06Z")

</div>

@pradeepkumarl Can you attach the full url to retrieve the code? What is the redirect URI?  
I think you are currently following the correct guide. You just need to exchange code with the token.  
In your postman, did you configure client\_id and secret under authorization tab?  
Also, the code is expired very soon. It is better to set up postman environment well first and then request a code. Once you get a code, fill it in postman soon and click send button.

---

<div class="post-metadata">

**Author:** ![pradeepkumarl](https://avatars.discourse-cdn.com/v4/letter/p/65b543/32.png) [@pradeepkumarl](https://devforum.okta.com/u/pradeepkumarl)\
**Post date:** [September 15, 2021, 3:22am UTC](https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136/3 "2021-09-15T03:22:23Z")

</div>

I was able to troubleshoot the issue. The code was already used by the application to exchange the access token from the authorization server.

---

<div class="post-metadata">

**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\
**Post date:** [September 15, 2021, 11:31pm UTC](https://devforum.okta.com/t/authorization-code-grant-flow-is-returning-invalid-authorization-code/16136/4 "2021-09-15T23:31:45Z")

</div>

Closed on September 15, 2021, 11:31pm UTC