barnabyand according to the spec it MUST only be usable once, which means you either have to persist them somewhere and delete/expire them after they’re exchanged, OR keep track of which ones have been exchanged in your list of access tokens and check against that
