'Validate the authorization code.
The client MUST NOT use the authorization code more than once. If an
authorization code is used more than once, the authorization server
MUST deny the request and SHOULD revoke (when possible) all tokens
previously issued based on that authorization code. The authorization
code is bound to the client identifier and redirection URI.'

def create_token_response(self, request, token_handler):

    headers = {u'Content-Type': u'application/json', u'Cache-Control': u'no-store', u'Pragma': u'no-cache'}
    try:
        self.validate_token_request(request)
        log.debug(u'Token    request    validation    ok    for    %r.', request)
    except errors.OAuth2Error as e:
        log.debug(u'Client    error    during    validation    of    %r.    %r.', request, e)
        return (headers, e.json, e.status_code)
    token = token_handler.create_token(request, refresh_token=self.refresh_token)
    self.request_validator.invalidate_authorization_code(request.client_id, request.code, request)
    return (headers, json.dumps(token), 200)
