OK, I've been staring at this for a while. I am not clear whether you are requesting an initial access token or a refresh token.
I personally don't much like SFormat - I prefer to build up my strings bit by bit where I can see them - however it looks to me as though that might be where the problem is.
In the docs it says the POST body for requesting an access token should read:"grant_type=authorization_code&code=<authorization_ code>&redirect_uri=<redirect_uri>".
AFAICS, your line of code: Move (SFormat("grant_type=%1&refresh_token=%2&redirect_ uri=%3", "refresh_token", sRefreshToken, "https://localhost:44300/callback")) to sURL will result in sURL (which would be less confusingly called sBody) being: "grant_type=refresh_token&refresh_token=<sRefreshTo ken>&redirect_uri=https://localhost:44300/callback".
So this is where I am confused - are you requesting an access token or a refresh token?
Personally I'd lose the SFormat stuff - from my PoV it just makes things harder to read.
I'd do:
Code:
String[] asPaths
String sBody
// Assummes sToken already contains the authorization code and that
// sRedir contains your redirect URL: "https://localhost:44300/callback"
Move ("grant_type=authorization_code") to asParts[0]
Move ("code=" + sToken) to asParts[1]
Move ("redirect_uri=" * sRedir) to asParts[2]
Move (StrJoinFromArray(asParts, "&")) to sBody
OTOH if you are actually requesting a refresh token, you need to lose the last bit about the redirect uri, as the doc says that should just be: "grant_type=refresh_token&refresh_token=<refresh_t oken>".
Mike