duplicate_grant error on repeated OAuth token request

Determine whether an authorization server treats a retried token request as idempotent by returning either a duplicate_grant error or the originally issued access token, thereby preventing duplicate writes after a transient failure.

The OAuth 2.0 RFC 6749 does not define idempotency for the token endpoint, so behavior varies: some servers detect duplicate grant parameters and return duplicate_grant, others may issue a new token, and the optional Idempotency‑Key header remains unimplemented in most deployments. Given this uncertainty, what response should a client expect, and how can it safely handle retries?

Does the server return duplicate_grant error for an identical token request after a timeout? If duplicate_grant is not returned, does it reuse the previously issued token instead of creating a new one? What client‑side mechanism guarantees idempotent token acquisition without relying on server‑specific behavior?