Endpoints that take action on the user's behalf return 403 error

[NurMarvin]

I just implemented the OAuth2 access token flow and now I'm getting the following error response on every API endpoint that tries to perform an action on behalf of the user, such as liking a track, creating a playlist, etc:

{
  "error": "Access to this resource has been disallowed"
}

I've confirmed that the OAuth2 access token I received through the flow works on API endpoints that are just receiving information, such as getting information about a route, so I'm pretty sure I've implemented the OAuth2 flow correctly. However, I can't seem to find any documentation on this error, so I'm wondering if I'm doing something wrong after all or how to fix it.

[dpreussler]

Hi @NurMarvin
It sounds like you are using the "Client Credentials" flow. You can not use those credentials to take actions on behalf of users.
You need to go through the "Authorization Code" flow which a proper user login.

Let us know if you have further question.

[NurMarvin]

I'm aware of the difference between the two flows and I did specify an authorization_code grant type when sending a request to https://secure.soundcloud.com/oauth/token.

Here's the entire code I've used for receiving the Access Token:

export async function getTokens(code: string): Promise<TokensReponse> {
  const url = new URL("https://secure.soundcloud.com/oauth/token");

  const searchParams = new URLSearchParams();

  searchParams.append("grant_type", "authorization_code");
  searchParams.append("client_id", import.meta.env.PUBLIC_SOUNDCLOUD_CLIENT_ID);
  searchParams.append(
    "client_secret",
    import.meta.env.SOUNDCLOUD_CLIENT_SECRET
  );
  searchParams.append(
    "redirect_uri",
    import.meta.env.PUBLIC_SOUNDCLOUD_REDIRECT_URI
  );
  searchParams.append("code", code);

  return fetch(url.toString(), {
    method: "POST",
    headers: {
      Accept: "application/json; charset=utf-8",
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: searchParams,
  }).then((res) => res.json());
}

I've also tried to go through the entire flow manually using the cURL commands provided at https://developers.soundcloud.com/docs/api/guide#auth-code with the same results