Yup, either a single sha256 (since we're dealing with 256-bit secrets), or you could use PBKDF2(rounds=1) which is nearly the same thing.

That works as long as the secret is exercised by delivering it to the server, which I think is fine (and defined by the spec) for "code". For the final OAuth tokens, we might want to exercise them by e.g. using them as a HAWK HMAC key, which means that the server must remember the original value instead of a hash. I'm still trying to figure out what style would be best for those tokens.