Hello @ricki.boyle welcome to the community!
You are on the right track. The particulars of the problem may be due to the initialization of api calls once you have a token that you can pass to get refresh one or ones.
I have not gone in detail through your well explained post.
So, my suggestion may be way out of “whack” but I will still like to share it to see if it may help.
Consider reading through how this oAuth is put together for a Hubspot integration. It is well explained and could shed some light on some missing step or angle that you may not be considering .
Hope it helps. @ambroisedlg did a heck of a job putting this together! 