diff --git a/server/src/server/router/api/v1/config/router.ts b/server/src/server/router/api/v1/config/router.ts
index 97fb7b8d9..f98f734bf 100644
--- a/server/src/server/router/api/v1/config/router.ts
+++ b/server/src/server/router/api/v1/config/router.ts
@@ -7,6 +7,8 @@ const router: Router = Router({ mergeParams: true });
 /**
  * Returns Tachi Configuration info, such as server name, type, supported games
  * and more.
+ *
+ * @name GET /api/v1/config
  */
 router.get("/", (req, res) =>
 	res.status(200).json({
diff --git a/server/src/server/router/api/v1/oauth/router.test.ts b/server/src/server/router/api/v1/oauth/router.test.ts
index f55c9563e..306d9194f 100644
--- a/server/src/server/router/api/v1/oauth/router.test.ts
+++ b/server/src/server/router/api/v1/oauth/router.test.ts
@@ -32,6 +32,10 @@ t.test("POST /api/v1/oauth/token", (t) => {
 			"Should assign the permissions this client has configured."
 		);
 
+		const exists = await db["oauth2-auth-codes"].findOne({ code: "AUTH_CODE" });
+
+		t.equal(exists, null, "Should remove the code from the database after being used.");
+
 		t.end();
 	});
 
diff --git a/server/src/server/router/api/v1/oauth/router.ts b/server/src/server/router/api/v1/oauth/router.ts
index 247679288..c1458cd15 100644
--- a/server/src/server/router/api/v1/oauth/router.ts
+++ b/server/src/server/router/api/v1/oauth/router.ts
@@ -67,6 +67,9 @@ router.post(
 			});
 		}
 
+		// don't let people auth with the same code multiple times.
+		await db["oauth2-auth-codes"].remove({ code: req.body.code });
+
 		const apiDoc = {
 			userID: codeDoc.userID,
 			token: Random20Hex(),