It looks like you're attempting to use the auth code grant, which appears to be behaving correctly based on what you're doing. The auth code grant is a flow that a user completes in a browser, which is why you're getting an HTML page back. You're not making the request from a browser, so the response isn't usable by you in your context.