refresh token is malformed

Yes, you are right. I am dumb. Thank you for the help @Здравко . I treated the authorization code as refresh token.
My story -

I want to post images to dropbox from netlify functions. I used short lived access tokens , since they expire i wanted refresh token to get a new short lived access token.

Solution for someone like me- (If your use case is similar to mine)

Step 1 - Generate authorization code for your app through the following url by replacing <APP_KEY> with your app key.

https://www.dropbox.com/oauth2/authorize?client_id=<APP_KEY>&token_access_type=offline&response_type=code

Step 2 - After replacing visit the url and grant authorization. An authorization code will get generated (43 characters approx). copy that.

Step 3 - Now we have to pass authorization code, app_key , app_secret to curl request to generate refresh token. I am using postman.  

Flow - Open Postman -> Import -> Raw text -> paste curl request and replace <APP_KEY>, <APP_SECRET>, <ACCESS_CODE> (i.e authorization code) -> Continue -> Send Request.

curl --location --request POST 'https://api.dropboxapi.com/oauth2/token' \
-u '<APP_KEY>:<APP_SECRET>'
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'code=<ACCESS_CODE>' \
--data-urlencode 'grant_type=authorization_code'

 Done - You have obtained json which contains refresh_token. 

________________________________________________________________________________

Now if you want to get new access token , you can use below code. or use dropbox sdk.

Code - 

const axios = require('axios');

	const clientId = 'xx';
	const clientSecret = 'xx';
	const refreshToken = 'xx';
	
	axios({
	  method: 'post',
	  url: 'https://api.dropbox.com/oauth2/token',
	  params: {
		grant_type: 'refresh_token',
		refresh_token: refreshToken,
		client_id: clientId,
		client_secret: clientSecret
	  }
	})
	.then(response => {
	  const accessToken = response.data.access_token;
	  console.log(`Access token: ${accessToken}`);
	  // Use the access token to make API requests
	})
	.catch(error => {
	  console.error(error);
	});