Authorization code already used

What it means

Codes are single-use. If the company’s redirect page is a live app, it probably exchanged the code itself before you pasted it.

For testing, register a loopback redirect (http://localhost:PORT/callback) or a redirect page that does nothing, then use that.

server responseEpic public sandbox (fhir.epic.com)

{
  "error": "invalid_grant"
}

server responsePublic vendor sandbox

{
  "error": "invalid_request",
  "error_description": "Authorization code in the request is not valid"
}

server responsePublic vendor sandbox

{
  "error": "Invalid Grant"
}

server responsePublic vendor sandbox

{
  "error": "invalid_code"
}

Run your login and smart-doctor ranks this cause against the others, with the evidence it found.

npx smart-doctor check my-profile

Already have the server’s error? Explain it without running anything.

npx smart-doctor explain '{"error":"invalid_grant"}'