In your OP you were using the “old” version of the authentication system.
You should be using
You should still use code.
token is for OAuth Implicit Code Flow
code is for OAuth Authorization Code Flow
client_credentials is for OAuth Client Credentials Flow
Token as a auth method is more for apps that you release the application to be downloaded (such as mobile apps) you don’t get a refresh token. It works but generally the oAuth Authorization flow is preferred.
It sounds like you were calling the code flow and then not exchanging the code for a token (post 2).
You should refer to
to be sure you are obtaining the right kind of tokens for your Application. The one you are using, the codes expire and cannot be refreshed by your application