I recently built my app's OAuth v2 integration in sandbox, and kept running into:
{'status': 'Unauthorized', 'message': 'Failed to validate authentication code.'}
Turns out, the code being passed to my API was from 'oauth/authorize' instead of '/oauth/v2/authorize'. This is the default for navigating from the left panel in sandbox as well as the default for clicking "Example OAuth Request" in the Edit REST Configuration Menu.
SOLUTION:
Change
https://sandbox.dev.clover.com/oauth/authorize?client_id={CLIENT_ID}
to
https://sandbox.dev.clover.com/oauth/v2/authorize?client_id={CLIENT_ID}
