Refer to the API Authentication docs; there are a great many things wrong with the URL in the question (at least 5).
For starters, it's to the wrong path.
stackoverflow.com/oauth/authorize gives helpful messages/results like:
Oops! Something Bad Happened!
Authorization attempt not valid for current user
Authorization attempt unauthorized
None of these messages hint at the real problems.
Anyway the correct URL per the (incorrect) docs is
But it's more correct to use:
All the extra and redundant parameters you were passing are normally ignored (or sometimes throw an error).
The correct way to get an access token is like:
(Click it and see)
If you want to pass additional security values, they must be the
For example, calling:
Note the comma-separated values.
The above call yields:
decodeURIComponent decodes to:
state=nonce=HDE6GdCU,ticks=636889445649720585 (the value passed in).