Invalid Authorization Code

Thanks for taking the time to look over this. As you pointed out, it was indeed the typo. $oauth does contain the token!

So I have to be sending the refresh token, and not the original auth code, to maintain the auth token?