@jon.correa I finally figured out my issue. postman was setup right. the problem was my that restlet did not have the permission for the user tied to role I was trying to oauth with. Once i fixed the audience, it now works.