When using OAuth2 App-ID authentication with ArcGIS Online Applications, it is worth noting that the Feature Services being consumed by the application must be owned by the application author (the creator of the token). If the Feature Services are not owned by the application author, or are only shared to the application author, the user will receive an error.