Expected response body OAuth flow

I’m implementing an OAuth flow for my public app. Currently, after clicking on the install url, the connecting page would send a request to my API endpoint to handle the incoming payload (including the code), and after handling the body, my endpoint would return a 200 code:

res.status(200);

However, I found that sometimes HubSpot would send the requests twice to my endpoint, causing unexpected behaviour. My guess is that the response I sent is not expected structure, but I couldn’t find what’s an expected response body looks like in any documentation. Could anyone provide my with information or documentation on this issue please?

Please go through this documentation to install the app:
HubSpot OAuth Quickstart Guide

After installation, you will receive a code in the redirect URL.
You can exchange this code for access and refresh tokens by following this step:
Exchange Authorization Code for Tokens