get access token & refresh token

The mismatched redirect URI error indicates that the redirect_uri you're using on /oauth2/token doesn't match the redirect_uri used to retrieve that authorization code from /oauth2/authorize. Since you're not setting redirect_uri on /oauth2/authorize, you should also omit it when calling /oauth2/token.

When performing a call like this, be sure to print out the response body, as it will generally contain a more specific error message. It sounds like the error in the JavaScript case is likely the same as above though, or check the response body for the error message.

For JavaScript, we highly recommend using the official Dropbox JavaScript SDK, as it will do much of the work for you automatically. Refer to the examples included in the "examples" folder in the SDK. It implements the authorization flow steps and as long as you set the necessary credentials, like shown in this example for the JavaScript SDK, the SDK will actually handle refresh process for you automatically. The SDK will automatically catch expired access token errors and call the API to get a new short-lived access token when needed.