In reply to Ryan.

From the message ("invalid_grant") I'd guess that the authorization step (step 1) didn't yield a code or maybe you copied/pasted it incorrectly. Step 2 specifically includes "grant_type=authorization_code" to indicate the call should expect a valid code in the code= argument.