The authorization_code the app asked for. The app can make use of the authorization code to ask for an accessibility token for the goal useful resource. Authorization codes are short lived. Normally, they expire just after about ten minutes.InvalidExternalSecurityChallengeConfiguration - Claims despatched by external supplier is just not sufficient