Discussion posts and replies are publicly visible
Did you try client credentials grant instead of code grant?