I've compared it (the PHP version) to code that I've got in use and you're not missing anything that I can see. I'm using cURL with a follow option rather than file_get_contents... maybe there's a redirect in there somewhere?
$accessTokenPost = array( 'grant_type' => 'client_credentials',
'client_id' => LFS_OAUTH_CLIENTID,
'client_secret' => LFS_OAUTH_CLIENTSECRET);
$ch = curl_init(LFS_OAUTH_TOKEN_URL);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($accessTokenPost));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
if (!$result)
{
if ($debug)
{
echo 'failed to get token '.LFS_OAUTH_TOKEN_URL.' ';
var_dump($result);
var_dump($http_response_header);
}
exit();
}
$json = json_decode($result);
$bearerToken = $json->access_token;