Yes. We use the code we get in step 4. We tried two accounts, both with the same result. This is our call in step 5:
curl -X POST -d "client_id=yQ_-...&client_secret=KInb...&grant_type=authorization_code&code=2fd0...&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F..." https://api.nuki.io/oauth/token