lib/grant-types/authorization-code-grant-type.js
Line 77
The function returns:
return this.saveToken(code.user, client, code.authorizationCode, code.scope);
As per the documentation, code.authorizationCode is never passed, the actual authorization code is passed as code.code .