Today, I've successfully used POSTMAN to obtain an OAuth2.0 token and verify that its a read-write against the Thingiverse API. See screenshot.
Using that token and POSTMAN, I can view my list of things (including unpublished Things...indicating that it has user-specific privileges), list categories, etc.
However, when I've tried to create a new Thing or issue a simple update to my profile it fails. All I manage to get is a "Bad Request" returned from the API server. If anyone figures this out, let me know.