There are a few posts about this but I couldn't find one with an answer. API docs say to use the "authorization_code" grant_type, but I get a response saying that it is an unsupported type.
$params["grant_type"]     = "authorization_code";
$params["code"]           = {auth code from previous step}
$params["redirect_uri"]   = {endpoint for app}
$auth = base64_encode("$application_id:$shared_secret");
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER,
                                                array('Content-type: application/x-www-form-urlencoded',
                                                      "Authorization: Basic $auth",
                                                      ));
curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $content);