Authentication Flow - Verify the authorization code

Likely this:

Looking further, you are posting ‘grant_type=authorization_code&code=’.$code)); as a header and not the body.

I recommend using a library for oauth2, not rolling your own.