Unable to get access token from Workday's OAuth2 token endpoint - oauth-2.0

Question

I'm trying to implement an OAuth 2 client to Workday and I'm getting hung up on trying to request a token. I can call the authorization endpoint and it redirects to my callback with the authorization code just fine, but when I try to post the authorization code to the token endpoint, I get:
"{\"error\" : \"application=service - invalid_request\"}"
I've tried different combinations of URL encoding on the request_uri. I've tried passing a state parameter. I've even gone as far to proxy the call to make sure the I was actually sending the correct information. Here is the PHP code I wrote to try and retrieve the token.
function callback() {
$code = $_GET["code"];
log_message('info', 'Using code: ' . $code);
$url = "https://wd5-impl-services1.workday.com/ccx/oauth2/<redacted>/token";
$data = array(
'client_id' => '<redacted>',
'client_secret' => '<redacted>',
'grant_type' => 'authorization_code',
'code' => $code,
'redirect_uri' => 'https://<redacted>/account/callback'
);
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_VERBOSE, 1);
$result = curl_exec($curl);
log_message('info', json_encode(curl_getinfo($curl)));
curl_close($curl);
log_message('info', json_encode($result));
#redirect(base_url()."account/login");
}
I'm kind of at a lost as to what is wrong. I've combed all the forums and I've tried to compare against conversations regarding other OAuth 2 servers, but I cannot find anything on my specific problem. Has anyone else successfully done this with Workday?

Answer 1

Try this...
it worked for me:
curl -X POST \
https://wd2-impl-services1.workday.com/ccx/oauth2/ <tenant> /token \
-H 'Authorization: Basic T0RJM1pqa3pZbVV0WXpBeU15MDBZV0kwTFRnMU4yRXROV1UyTW1Wak16ZzFNamxqOmNudzZwbDI3Zmc4eG54YWIxamE1cWR6cHlqMGtkZW9mdmNubjF0czhyN3U2OHpiZ3llOTJyajZvbWhiMjY3ZjlrYzE0ajU3d3F5cHQyNjN5Ymc3N3h3ZXdvc3h2bmVodTc1Mw==' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'Host: wd2-impl-services1.workday.com' \
-H 'cache-control: no-cache' \
-H 'content-length: 60' \
-d 'grant_type=authorization_code&code=4pwzdn1vs63alnm1fyas62za6'
Its result is:
{
"refresh_token": "r50ditl18yt0osdfnoasdsadfouwerljsdfkauooiu5h5hvanlkf8ow5n9ugjc3d8wiz99c6xxbi2t8ruqhxhohfzl4jfmuy",
"token_type": "Bearer",
"access_token": "e1zrm1ccwb9werwer6upb3tkp"
}