A request with a code and no grant_type is GitHub's code exchange. The plugin checks the secret, the code, its redirect_uri and PKCE; Ghost then revokes the plugin's token and mints a key, as the device flow does, answering with GitHub's error codes.