holy crap I was missing the scope param this whole time, stupid oauth