I'm using this with your Sinatra gem.
After many debug prints, I found a bug here on this line:
https://github.com/atmos/warden-github/blob/master/lib/warden/github/oauth.rb#L50
That's basically assuming that any time we fail to get exactly what we want in response to authentication, we claim it's a Bad Verification Code, when really, any of the GitHub OAUTH errors will get pushed through there.
My workaround to figure out my problem was to split the line before the rescue into
params = decode_params(response.body)
params.fetch('access_token')
I could then look at the params in the rescue section, which revealed the problem I was having and the easiest way to test this:
I had my GitHub client secret wrong.
Specifically, I was getting the Invalid Client Credentials error from this page:
https://developer.github.com/v3/oauth/#common-errors-for-the-access-token-request