what is the process for validating the authorization code?

How can we validate the authorization code received for generating an OAuth token? Specifically, what are the criteria for determining if it is a valid authorization code, including its length, format, or any necessary regular expressions?