Have you made sure your client id, secret and redirect being sent in the querystring match exactly to whats listed for your app in the dev dashboard? A good way to make sure would be to look at the response object as that will contain exactly what was sent.