This usually means the code has been used twice.
But the URL you created is for implicit auth. (response_type token)
Implicit doesn’t need the second step that you are trying to do as it returns the access_token from the start
These sort of tokens cannot be renewed, so you should probably be using
response_type code
Which does need the second step you are trying to do