Got it, the oktaUrl looks like the first line I can see in the paste.
The error is accurate, you can only send the client id and secret in either the post body or the HTTP header, so you’ll either need to remove the client_id and client_secret from the post body parameters or remove the Authorization header.
Also you’ll want to properly form-encode the post body parameters. I’d recommend using an HTTP client that has that built in rather than building the post body by hand.