Stored procedures are stored in the database schema I believe.
If you add the schema to your query SQL server should know where to "look" for your stored procedure.
$query = "EXEC [dbo].[sp_getToken] @userId=:userId, @pwd=:pwd";
Also when binding the parameters it might help defining the type. I've had issues with SQL server where defining the parameter typed resolved the issue.
$stmt->bindValue(':userId', $userId, PDO::PARAM_STR);
$stmt->bindValue(':pwd', $pwd, PDO::PARAM_STR);
Also, make sure that the user that PHP logs into the database has the Execute permission in SQL Server.
https://learn.microsoft.com/en-us/sql/relational-databases/stored-procedures/grant-permissions-on-a-stored-procedure?view=sql-server-2017
In Object Explorer, connect to an instance of Database Engine and then expand that instance.
Expand Databases, expand the database in which the procedure belongs, and then expand Programmability.
Expand Stored Procedures, right-click the procedure to grant permissions on, and then click Properties.
From Stored Procedure Properties, select the Permissions page.
To grant permissions to a user, database role, or application role, click Search.
In Select Users or Roles, click Object Types to add or clear the users and roles you want.
Click Browse to display the list of users or roles. Select the users or roles to whom permissions should be granted.
In the Explicit Permissions grid, select the permissions to grant to the specified user or role. For a description of the permissions, see Permissions (Database Engine).
Selecting Grant indicates the grantee will be given the specified permission.
Selecting Grant With indicates that the grantee will also be able to grant the specified permission to other principals.
bindValue()tobindParam().