Discussion posts and replies are publicly visible
Did you try client credentials grant instead of code grant?
Are you sure that you configured the callback URL correctly while registering with resource?