The documentation (http://developers.box.com/oauth/) suggests using POSTMAN or curl.
in this example, the clientID is 123, secret code is 456 and so on.
I a
I believe the problem with the /token request is that you're putting the parameters in the query string. These should instead be included in the POST request body.
/token