I'm a bit stuck but in my defense, I'm passing a kidney stone and not thinking clearly. 

I have a Visualforce page that opens in a newly created object record. One version will be the standard Contacts object while the other will be a custom object, payment__c.

What I'm pasting below works fine when it has the proper credentials in place. However, I'm missing the reference to the record I'm opening it from. I've tried doing this using a  list function but I must be putting it in the wrong location, or I shouldn't be using a list function at all. 

List Function (that I can't figure out where/how to put it into the Apex Class so I've pulled it out entirely)

List<Payment__c> records = [
    SELECT Id, Name, Amount__c
    FROM Payment__c
];

Controller
This controller makes an external call out to first authenticate and then initiate a session with that external service.  In this example, I'm opening the VF page from a Payment__c record. So I need to pass the ID, Name, and Amount__c to the external service as part of the initial values that you'll see around line 51. 

public class authRequestGenericV2 {
    public string actionURL {get;set;}
    public string access_token{get;set;}
    public authRequestGenericV2(){
        startTest();
    }
    public pageReference testMethodd(){
     return null;   
    }
    public Void startTest(){
        String authUrl = 'actualAuthurl';
        String client_id =  'actualClientId';
        String client_secret = 'actualClientSecret';
        String tenantname = 'actualTenantName';
        String username = 'acutalusername';
        String grant_type = 'actualClientCredentials';
        String platform = 'actualPlatform';
        
        Http http = new Http();
        HttpRequest request = new HttpRequest();
        request.setEndpoint(authURL);
        
        request.setMethod('POST');
        request.setHeader('Content-Type', 'application/x-www-form-urlencoded');
        String payload= 'grant_type=' +EncodingUtil.urlEncode(grant_type, 'UTF-8')+'&client_id=' +EncodingUtil.urlEncode(client_id, 'UTF-8')+'&client_secret=' +EncodingUtil.urlEncode(client_secret, 'UTF-8')+'&tenantname=' +EncodingUtil.urlEncode(tenantname, 'UTF-8')+'&username=' +EncodingUtil.urlEncode(username, 'UTF-8');
        System.debug(payload);
        
        request.setBody(payload);
        HttpResponse response = http.send(request);
        
        
        // Parse the JSON response
        if (response.getStatusCode() != 200){
            System.debug('The status code returned was not expected: ' +response.getStatusCode() + ' ' + response.getStatus());
        } else {
            System.debug(response.getBody());
            AccessToken tokenObj = (AccessToken)JSON.deserialize(response.getBody(), AccessToken.Class);
            access_token = tokenObj.access_token;
            String session_req_url = 'actual_session_req_url';
            
            // Session Request
            Http sessionHttp = new Http();
            HttpRequest sessionRequest = new HttpRequest();
            
            sessionRequest.setEndpoint(session_req_url);
            sessionRequest.setMethod('POST');
            
            sessionRequest.setHeader('Content-Type', 'application/json');
            sessionRequest.setHeader('Accept', 'application/json');
            sessionRequest.setHeader('Authorization', 'Bearer ' + tokenObj.access_token);
               
            String session_request_body = '{"FlowId":actualNumericValue,"InitialValues":{"paymentID": "{Payment__c.Name}", "Amount": "{Payment__c.Amount__c}", "SFID": "{Payment__c.Id}"}';
            sessionRequest.setBody(session_request_body);
            
            HttpResponse sessionResponse = sessionHttp.send(sessionRequest);
            
            // Parse the session JSON response
            if (response.getStatusCode() != 200){
                System.debug('The session status code returned was not expected: ' +response.getStatusCode() + ' ' + response.getStatus());
            } else {
                System.debug(response.getBody());
                // Parse entire JSON response.  
                String sessionjsonStr = sessionResponse.getBody();
                System.debug('::::::: Response::' + sessionjsonStr);
                sessionjsonStr = sessionjsonStr.replace('"Id"','"Idd"');
                system.debug(':::sessionjsonStr:::' + sessionjsonStr);
                ResponseResult resultObj =(ResponseResult)JSON.deserialize(sessionjsonStr, ResponseResult.Class);
                system.debug(':::resultObj.Id' + resultObj.Idd );
                system.debug(':::resultObj.LinkId' + resultObj.LinkId );
                actionURL = 'https://baseActionURL' + resultObj.Idd + '/framed';
            }
            
        }   
        
    }
    public class AccessToken{
        public string access_token{get;set;}
    }
    Public class ResponseResult{
        public string Idd{get;set;}
        public string LinkId{get;set;}
    }
    
}

VisualForce Page that is an embedded iframe

<apex:page controller="authRequestGenericV2">
    <iframe name="embeddedframe" src="about:blank" style="height:800px; width:600px; border-style:unset;"></iframe>  
	
    <form action="{!actionURL}" id="initForm" target="embeddedframe" method="POST">
 
        <input name="X-BEARER-TOKEN" value="{!access_token}" type="hidden"> </input>
    	<input name="X-REFRESH-TOKEN" value="{refresh_token}" type="hidden"> </input>
</form>
<script>
document.getElementById("initForm").submit();
</script>

</apex:page>

 

I'm looking for some guidance after days of searching SF, forums, tralblazer, etc. I haven't worked in SF in a very long time.
In my mind what I need to do is simple, but everything I seem to find leads me down a path of complex development. Maybe I'm searching on the wrong terms. 

Here is what I'm trying to do. 
Use case - User needs to click a button(action, etc.) in a record to open to an externally hosted site to perform a task that ties to the SF record they're working in. On click, it would automatically authenticate to the site, pass initial values, and then open the web page in an iframe (preferable), or in a new browser window/tab with the initial values populated. 

Basic logic - (at least in JSON)