def METHOD_NAME(auth_client: globus_sdk.AuthClient, auth_code: str) -> None:
    """
    Finishes auth flow after code is gotten from command line or local server.
    Exchanges code for tokens and stores them.
    A user may have a different identity this time than what they previously logged in
    as, so to secure incremental auth flows, if the new tokens don't match the previous
    identity we revoke them and instruct the user to logout before continuing.
    """
    adapter = token_storage_adapter()
    tkn = auth_client.oauth2_exchange_code_for_tokens(auth_code)
    # use a leeway of 64s
    #
    # this value was arrived at by mixing:
    # - expected clock drift per day (6s for a bad clock)
    # - Windows time sync interval (64s)
    # - Windows' stated goal of meeting the Kerberos 5 clock skew requirement (5m)
    # - ntp panic threshold (1000s of drift)
    # - the knowledge that VM clocks typically run slower and may skew significantly
    # - a dash of guesswork
    # - rounding the nearest power of 2
    sub_new = tkn.decode_id_token(jwt_params={"leeway": 64})["sub"]
    auth_user_data = read_well_known_config("auth_user_data")
    if auth_user_data and sub_new != auth_user_data.get("sub"):
        try:
            for tokens in tkn.by_resource_server.values():
                auth_client.oauth2_revoke_token(tokens["access_token"])
                auth_client.oauth2_revoke_token(tokens["refresh_token"])
        finally:
            click.echo(
                "Authorization failed: tried to login with an account that didn't "
                "match existing credentials. If you meant to do this, first `globus "
                "logout`, then try again. ",
                err=True,
            )
        click.get_current_context().exit(1)
    if not auth_user_data:
        store_well_known_config("auth_user_data", {"sub": sub_new})
    adapter.store(tkn)