Yeah, we create all codes and tokens, so we can enforce whatever rules we like. "Unique in the DB" is a fine rule. Especially since these things are supposed to be unguessable.. if we did manage to have the same code in two different places (for different client_ids), then one of the clients would be able to guess the other one.