Well, in your console log you misspell $oauth, so that may be your problem. You’re actual PHP code looks fine as far as I can see. And yes, you can only exchange the auth code for an auth token once, so refreshing the page is expected to give “Invalid auth”.