Get 403 in Postman trying to GenerateToken or List Group/Reports after getting access token

Thanks, v-ljerr-msft. My problem was not that. Actually I just figured out my problem with Azure AD support, so let me share it here. Hopefully it can benefit others. The reason for the 403 was because the Power BI account I used was an internal domain account, and at Microsoft only corp account can share content with Pro license, not internal domain account. The 403 forbidden was right, but I wish it indicated why. I did scratch my head for quite a while. 

The lesson to learn here is because I was able to get the access token using Postman, that indicated the Auth URL and Token URL were working for me. The Power BI API end point was not working, and that indicated app permission issue.

Also because I was doing "app owns data", I should have registered my app as Native App, not Server Side/Web App, even though I was going to embed my reports inside a web app. This was very confusing and counter-intuitive. I needed to give interactive consent for the user/service account I was using. This was a one time set up, after which my app was able to get both access token and the embed token, embed URL, etc.