Never getting refresh_token

API
4

That looks correct,

And I assume you are redirecting the user there, not doing a cURL fetch or anything silly?

Whats the second leg of your oAuth look like (the POST for code->token exchange)