POST /secure/token HTTP/1.1
Authorization: Basic строкаАвторизации
Content-Type: application/x-www-form-urlencoded

Request Body:
grant_type=authorization_code&code=<код авторизации>&redirect_uri=<URL возврата>

$params=[
   'grant_type'=>'authorization_code',
   'code'=>$code,
   'redirect_uri'=>$uri
];
$headers = [
   'POST /secure/token HTTP/1.1',
   'Content-Type: application/x-www-form-urlencoded'
];
$curlURL='https://sso.tinkoff.ru';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$curlURL);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, $user . ":" . $pass);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,http_build_query($params));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_VERBOSE, true);

if(curl_exec($ch)) {
   $server_output = json_decode(curl_exec($ch));
}