Facebook API & OAuth protocal

http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-10.5

Code
REQUIRED. The authorization code generated by the
Authorization server. The authorization code must expire
Shortly after it was issued to mitigate the risk of leaks. A
Maximum authorization code lifetime of ten minutes is
RECOMMENDED. The client must not use the authorization code
More than once. If an authorization code was used more than
Once, the authorization server must deny the request and should
Revoke (when possible) all tokens previously issued based on
That authorization code. The authorization code is bound to
The client identifier and redirection URI.

Authorization codes must is short lived and a use

Access_token should be posted

Facebook API & OAuth protocal