[OAUTH-WG] One-time token login

[Evert Pot <[e-mail]>]

Dear list,

We have a requirement to let users log in to an application via a code 
sent by email.
This code needs to be exchanged for an access/refresh token pair, and 
should only work once.

The access/refresh token scope would give limited access to the 
application. Since we already use the authorization_code flow for other 
(more sensitive) parts of the application, I would like to re-use the 
OAuth2 framework for parts of this.

It doesn't sit right with me to overload the 'code' in 
authorization_code, so I was considering introducing a new custom 
grant_type for our application, specific for this purpose.
It seems that grant_type in the 'token' endpoint would support extension 
in this manner, by using a uri such as https://vendor.example/email-token

I'm comfortable implementing this, but curious:

 1. Is there already some prior art that I'm not aware of? I'd rather
    not do a custom grant_type if there's something standard I could do.
 2. Are there any major pitfalls associated with this?

Evert