Sounds like you forgot to take the code and exchange it for an access token in your oAuth loop (step 3).
You have requested an implicit code with will die and cannot be renewed automatically. So you should “upgrade” to the normal oAuth token so you can refresh it automatically.
Rechecking your commented code from earlier, your step 3 doesn’t wait for step 2 to complete.
Step 1) Link out (redirect)
Step 2) Receive ?code (incoming GET)
Step 3) Exchange code for access_token and refresh_token (outgoing POST)