**lib/grant-types/authorization-code-grant-type.js** Line 77 The function returns: `return this.saveToken(code.user, client, code.authorizationCode, code.scope);` As per the documentation, code.authorizationCode is never passed, the actual authorization code is passed as **code.code** .