I had the same problem. According to [the authentication docs][1]<sup>&ddagger;</sup>:

> In order to get access_token and expires (if applicable) wrapped in a
> JSON object, POST to https://stackoverflow.com/oauth/access_token/json
> instead.

<br>

----------
<sup>&ddagger;</sup> Now.  The Doc pages [did not say this back in 2013][2].


  [1]: https://api.stackexchange.com/docs/authentication
  [2]: https://web.archive.org/web/20140215002828/https://api.stackexchange.com/docs/authentication