How to get an ACS app-only access token for Project Online

I'm trying to get an AppOnly access token for use in the Authorization Bearer header of my request to a REST endpoint in Project Online (SharePoint). Following is a snippet of the code that I was using to retrieve the access token.

    private OAuth2AccessTokenResponse GetAccessTokenResponse()
    {
        var realm = TokenHelper.GetRealmFromTargetUrl([[our_site_url]]);
        var resource = $"00000003-0000-0ff1-ce00-000000000000/[[our_site_authority]]@{realm}";
        var formattedClientId = $"{ClientId}@{realm}";

        var oauth2Request = OAuth2MessageFactory.CreateAccessTokenRequestWithClientCredentials(
            formattedClientId, 
            ClientSecret, 
            resource);
        oauth2Request.Resource = resource;

        try
        {
            var client = new OAuth2S2SClient();
            var stsUrl = TokenHelper.AcsMetadataParser.GetStsUrl(realm);
            var response = client.Issue(stsUrl, oauth2Request) as OAuth2AccessTokenResponse;

            var accessToken = response.AccessToken;
        }
        catch (WebException wex)
        {
            using (var sr = new StreamReader(wex.Response.GetResponseStream()))
            {
                var responseText = sr.ReadToEnd();
                throw new WebException(wex.Message + " - " + responseText, wex);
            }
        }
    }

I keep getting 403 Forbidden as the response from the server, even if I include site collection admin credentials with my request. Does anyone out there have any ideas?

After creating a support ticket with Microsoft to figure this out we eventually decided to move away from using app permissions for console application authorization.

Our workaround was to create SharePointOnlineCredentials object using a service account, and then get the Auth cookie from the credentials object to pass with our WebRequest. This solution came from scripts found here: https://github.com/OfficeDev/Project-REST-Basic-Operations