You’ll find the entire process easier to manage if you use HTTP headers instead of query string parameters for auth.
Keep in mind also that you’re using a retired URL. You want https://api.twitter.com/oauth/access_token (and the api subdomain for all requests in this process).