For PHP you really should not be using implicit auth. As a “server” cannot see the URL Fragment. Implicit auth is intended to be used for apps that don’t have a server.
You should use something like
- Redirect to Twitch
- They come back with a code
- Exchange the code for an access token
- ???
- Profit