error.code, which never changes. error.message is written for people and may be reworded.
The one exception is
POST /oauth/token, which uses OAuth 2.0’s own error format so OAuth libraries understand it: { "error": "invalid_grant", "error_description": "…" }.