{ status: 400, message: 'Invalid authorization code' }

The code is already used is a common problem here. As the code is a one use code to be exchanged for a token

The code should be dynamically obtained from the URL as it’s a query strin parameter and not hard coded.