title: Instagram API returns a code, but when requesting an access token says the same code is invalid
body: <p>Using the Instagram rubygem and sinatra I am able to successfully authenticate via oauth from a small AngularJS app and use the Instagram API. Here are the relevant oauth routes from my sinatra app:</p>
  
  <pre><code>get '/oauth/connect' do
      logger.info "going here " + (Instagram.authorize_url :redirect_uri =&gt; CALLBACK)
      redirect Instagram.authorize_url :redirect_uri =&gt; CALLBACK
  end
  
  get "/oauth/callback" do
      logger.info params[:code]
      response = Instagram.get_access_token params[:code], :redirect_uri =&gt; CALLBACK
      session[:access_token] = response.access_token
  
      users = DB[:users]
      current_user = users[:instagram_id =&gt; response.user.id.to_i]
  
      if current_user.nil?
          new_user = response.user
          users.insert :instagram_id =&gt; new_user.id.to_i, 
                               :username =&gt; new_user.username, 
                               :profile_picture =&gt; new_user.profile_picture,
                               :created_at =&gt; DateTime.now
  
          current_user = users[:instagram_id =&gt; new_user.id]
      end
      session[:current_user] = current_user
      redirect "/app"
  end
  </code></pre>
  
  <p>However, when trying to authenticate from within a webview in an Android app using the same routes (GET oauth/connect, redirected to Instagram, then redirected back to oauth/callback) I get the following error:</p>
  
  <pre><code>Instagram::BadRequest - POST https://api.instagram.com/oauth/access_token/: 400: OAuthException: No matching code found.:
  </code></pre>
  
  <p>I have verified that I am using the same code returned from Instagram and that the redirect_uri is the same as what I registered with Instagram.</p>
  
  <p>Note, Oauth works when I use my web interface, but not via the Android webview.</p>
  
  <p>I have read a number of posts where other people have seen this behavior, but the solutions provided do not work for me:</p>
  
  <ol>
  <li><p>Instagram can disable your app because it thinks it is misbehaving. Nope, because oauth works via my web-interface still using the same client ID and secret and the same routes.</p></li>
  <li><p>You are not using the same redirect_uri as that listed with Instagram. I have checked and re-checked this and it looks fine.</p></li>
  </ol>
  
  <p>Where can I debug next to get to the bottom of this issue?</p>