You’re missing a step in the OAuth process. The Auth Code flow doesn’t return an access key and refresh token, it returns a code with the user to your redirect URI. Your server then has to exchange that code for the access and refresh tokens.
1 Like