title: New "OAuth2 Authorization code was already redeemed" error when getting an access code for an Office 365 resource
body: <p>We have the following steps to authenticate with Office 365 and get the access tokens required to request calendar events...</p>
  
  <ol>
  <li>Send the user to <a href="https://login.microsoftonline.com/common/oauth2/authorize?response_type=code" rel="nofollow noreferrer">https://login.microsoftonline.com/common/oauth2/authorize?response_type=code</a> , passing the client id and a redirect URL</li>
  <li>The user logs in and is redirected back to the redirect URL with a ?code= query string value</li>
  <li>Make an API request to <a href="https://login.microsoftonline.com/common/oauth2/token" rel="nofollow noreferrer">https://login.microsoftonline.com/common/oauth2/token</a> to get a token for the <a href="https://api.office.com/discovery/" rel="nofollow noreferrer">https://api.office.com/discovery/</a> resource, passing the code that we got in step 2</li>
  <li>Store the access token and refresh token which is returned</li>
  <li>Make an API request to <a href="https://api.office.com/discovery/v2.0/me/services" rel="nofollow noreferrer">https://api.office.com/discovery/v2.0/me/services</a> to get a list of end points that we have access to</li>
  <li>For the end point that I want to work with (Office 365 Exchange) , make an API request to <a href="https://login.microsoftonline.com/common/oauth2/token" rel="nofollow noreferrer">https://login.microsoftonline.com/common/oauth2/token</a> to get a token for the <a href="https://outlook.office365.com/" rel="nofollow noreferrer">https://outlook.office365.com/</a> resource, passing the code that we got in step 2</li>
  <li>Store the access token and refresh token which is returned</li>
  <li>Use the access token from step 7 to fetch calendar events</li>
  </ol>
  
  <p>This used to work fine, but today I'm getting a different result from the API call on step 6</p>
  
  <p>I used to get an access token and refresh token which I could use for the outlook.office365.com resource, but now I'm getting an error message like the following...</p>
  
  <pre><code>{
      "error":"invalid_grant",
      "error_description":"AADSTS70002: Error validating credentials. AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.
      Trace ID: 37f11c2c-6450-4040-b297-48268c6d4b00
      Correlation ID: afdeb0cb-c14a-4267-9a5d-2422a1f84d62
      Timestamp: 2019-01-29 22:26:24Z",
      "error_codes":[70002,54005],
      "timestamp":"2019-01-29 22:26:24Z",
      "trace_id":"37f11c2c-6450-4040-b297-48268c6d4b00",
      "correlation_id":"afdeb0cb-c14a-4267-9a5d-2422a1f84d62"
  }
  </code></pre>
  
  <p>So it looks like I need to pass a different code the second time I make a request to get access tokens, but where do I get this different code from?</p>