Unfortunately I would not be the best resource when it comes to navigating this via PHP but the step you’re referring to is in relation to the code which is passed as a URL parameter after the user has authenticated the integration.
When the OAuth URL is accessed, this will prompt the integration user to login to their portal and confirm the scope access, once this is done, the redirect will occur to the redirct_uri which will have the code appended to it. This will then need to be captured and used as part of the data in the request for the access and refresh tokens.
This could be captured by using something along the lines of:
For further assistance, I was able to find this thread that may assist:
Further to the above, I was able to find this resource for you:
I hope this helps!