You can authenticate via SOAP's login() command, which requires a username, password, and possibly a security token; a session Id is interchangeable with an access token (they are roughly synonymous). Or, you can use an User-Agent OAuth flow that authenticates via browser once, then uses a refresh token to stay logged in perpetually, even if the username or password changes. This is how the Salesforce DX CLI operates. Other techniques are possible as well, but these are probably the two most common.
The login flow is pretty straight-forward:
$loginResult = $client->login($username, $password . $securityToken);
$sessionId = $loginResult.sessionId;
Of course, don't forget to check for errors and reset the endpoint, as well (it's in the documentation).
The OAuth flow is more involved, as it requires a page to direct the user to Salesforce to log in, then a second page to access the token after logging in. It's not complicated, but it's not trivial either (and more code than I would want to put in to an answer).
There's plenty of examples of this out there on the Internet in the form of documentation, Help topics, Knowledge Articles, blog posts, sample repos... It's everywhere, just look around and you'll find something that will help you.