Why are you removing the code param. It needs to be there with the valid authorization code you receive with asking for authorization. Please make sure you are following the spec RFC 6749: The OAuth 2.0 Authorization Framework
Another thing I can see in your console that you are sometimes sending the wrong client_id in the authorization step. Make sure you use the key and secret under API Keys in the portal for your client_id and client_secret. Also I don’t see you sending a redirect_uri in the original authorization (this is required). You must then send the exact same redirect_uri along with the code returned in order to get an access and refresh tokens.