I'm creator of <a href="https://picodash.com" rel="nofollow">https://picodash.com</a>, I noticed the same issue about a week ago but did not get any complains from my customers, so debugged it for 8 hours until I found this (I know it will be hard to believe):<p>I kept getting "Matching code was not found or was already used." when using thru my oauth python code which btw has been working for 6 years now. But when I used curl to do POST, it worked, when I tried Curl again with same oauth code, it failed, So I think this is something that was recently changed by Instagram, the oauth code only works one time, I kind of remember this code could be used more than once before to make POST call, but there was time limit instead, after which using same code was failing.<p>So with me, this was always failing, but no complains from my customers, I could see logs that new people were signing up.<p>I started testing on localhost, I added debug logs, I did notice that there was 2 POST calls being made, so it was failing. I could see that 2 POST calls was made and first one did work and get access_token, but there was a second call made and this was error 400 and oauth flow was failing. Almost looked like a retry of POST call, cause my code should only make one.<p>I started trying different browsers, failed on all firefox,IE, safari, chrome. And then decided to try on my iphone, it worked 100%, so looked for difference, it was on LTE, so I guessed may be my wifi, switched to wifi on iphone and it started failing 100%. So now on my dev system, I connected modem directly to system without router and tried, it passed 100%, so it was my wireless router (I know weird), I tried another 3rd party instagram web app, had same issue but worked without the wireless router. So on Monday I got another wireless router and no issues, it started working. So this could be an isolated incident for me, I came to conclusion that I was using some old router that was dropping POST request and making second attempt and failing.<p>So I guess if this is affecting all your customer check you code by putting logs that you are making one POST request. Try making a CURL after you receive the code and make sure it is working on first attempt.<p>Today after reading this, I check my oauth login again, I did notice it fail few times, but when I try again, it is passing, so something changed again I think.