I believe the problem is that you're specifying all 5 values via the Request Header. Only Content-Type
is specified via the Header -- the other four parameters (client_id
, client_secret
, code
, and grant_type
) should be specified via the query string. You're getting the not authorized error because Smartsheet is looking for the value of client_id
etc. in the query string but not finding it there.
For example, here are screenshots from Postman that show setting Content-Type
via the Headers and the other four parameters via the Params:

