Here is a description I wrote showing in basic terms how you can get access tokens and then how you can refresh them.
It looks like you are certainly on the right path but it may be worth taking webhook.site out of the loop as you are really just interested in the URL.