Error when attempting to exchange authorization code for token

My authorization request returns this response:

Found. Redirecting to /u/login?state=hKFo2SBqWFB3ZDYyRVZHN0dadnNpZNkgMDd2dktvRWlqWEFUVmFDRXNZczZpZEJmQjFZc28zY1I

(I shortened the string above for brevity and security.)

Is the long string following "state=" in that response my "authorization code"? If so, why is it preceded by "state="? Either way, is that the "code=" value I should put in the cURL I subsequently send to https://a.roserocket.com/oauth/token to obtain a token? I tried that, but I then get this error response:

{"error":"invalid_grant","error_description":"Invalid authorization code”}

I'm generally confused about "state" vs "code" and what those values should be and how they relate to each other.

Can someone help me figure out what I'm doing wrong?