ok it's now at least *half* working

game-example/OAuth.cs

···
 	public TcpServer RedirectServer = new();
 	public string RedirectUri = $"http://{Binding}:{Port}";
 	
-	public string ClientId = "client_XTcqz8gXODW6yDv-lf9KJg";
+	public const string ClientId = "client_lvRAJmPuwePq5oEqoFR_Ww";
+	//I have completely given up on using DPoP for this demo.
+	// THIS IS FOR DEMONSTRATION PURPOSES ONLY! DO NOT USE A CLIENT SECRET IN AN APP PLAYERS WILL DOWNLOAD!
+	//(this is bound to my localhost docker container so you can't use this secret in prod anyway)
+	private const string clientSecret = "8f03wNGkVL8oOqd1IUAZaYFUrZBQTIXoC2o8Wo6wXl8";
+
+	public bool Authorized = false;
 
 	public string Token;
 	private string refreshToken;
···
 	// Called when the node enters the scene tree for the first time.
 	public override void _Ready() {
 		SetProcess(false);
+		//InitialAuth();
 	}
 
 	// Called every frame. 'delta' is the elapsed time since the previous frame.
···
 			if (!String.IsNullOrEmpty(request)) {
 				SetProcess(false);
 				//TODO: this seems sus, will need to check for quickslice
-				string authCode = request.Split("&scope")[0].Split("=")[1];
+				GD.Print($"Request result: `{request}`");
+				string authCode = request.Split(" HTTP/1.1")[0].Split("=")[1];
+				GD.Print($"Parsed auth code: `{authCode}`");
 				GetTokenFromAuth(authCode);
 
 				connection.PutData("HTTP/1.1 200\r\n".ToAsciiBuffer());
 				//TODO: response page here
-				connection.PutData("".ToAsciiBuffer());
+				connection.PutData("Authentication complete!".ToAsciiBuffer());
 				RedirectServer.Stop();
 			}
 		}
 	}
 
+	public async void InitialAuth() {
+		LoadTokens();
+
+		if (!await IsTokenValid()) {
+			if (!await RefreshTokens()) {
+				Authorized = false;
+				return;
+			}
+		}
+		Authorized = true;
+	}
+
 	public async Task Authorize(string handle) {
 		LoadTokens();
 
···
 
 	private void GetAuthCode(string handle) {
 		SetProcess(true);
-		RedirectServer.Listen(Port, Binding);
 		Error err = RedirectServer.Listen(Port, Binding);
 
 		string[] bodyParts = [
 			$"client_id={ClientId}",
+			$"client_secret={clientSecret}",
 			$"redirect_uri={RedirectUri}",
 			$"response_type=code",
 			//TODO: code challenge?
 			$"login_hint={handle}",
-			$"scope=atproto transition:generic"
+			"scope=atproto transition:generic"
 		];
 		string url = $"{AuthUrl}?{bodyParts.Join("&")}";
 
···
 		string[] bodyParts = [
 			$"code={authCode}",
 			$"client_id={ClientId}",
+			$"client_secret={clientSecret}",
 			$"redirect_uri={RedirectUri}",
 			"grant_type=authorization_code"
 		];
···
 		];
 		string[] bodyParts = [
 			$"client_id={ClientId}",
+			$"client_secret={clientSecret}",
 			$"refresh_token={refreshToken}",
 			"grant_type=refresh_token"
 		];
···
 		return false;
 	}
 
+	//TODO: Quickslice doesn't have a way to get token info! Need to refactor to check expiry + stored issue time directly
 	private async Task<bool> IsTokenValid() {
 		GD.Print("Checking if tokens are valid");
 		if (string.IsNullOrEmpty(Token)) {
···
 
 		string body = $"access_token={Token}";
 
-		Error err = Request.Request(TokenUrl+"info", headers, HttpClient.Method.Post, body);
+		Error err = Request.Request(TokenUrl, headers, HttpClient.Method.Post, body);
 
 		if (err != Error.Ok) {
 			GD.PushError($"HTTP error {err} occured while trying to check auth token validity");