I killed two days to solve this problem for myself, finally decided, though I have a java server, but I think it will not be a particularly big problem to understand. server is running on localhost!
So in steps: 1 - in vk on the page with the settings of the application you need to enable openAPI and in the settings of the hosts register localhost and the page that will be redirected from the https://oauth.vk.com/authorize method in the redirect_uri parameter in me it looks like this 
2 - you need to use server authorization and not client: a link to vk.api ie first you need to get the code
getCode { @Override public String getExactMethod() { return "https://oauth.vk.com/authorize?" + "client_id=" + AppProperty.properties.getProperty("vk.client.id") + "&scope=market" + "&display=popup" + "&redirect_uri=" + AppProperty.properties.getProperty("vk.client.uri.local") + "&response_type=code" + "&v=5.60"; } }
Thus, in the response, the code will come as the default get parameter. I get it and process it in the filter by assigning a class constant
3 - having received the code, you can send a GET request to https://oauth.vk.com/access_token using HttpClient; for me it looks like this: forming a request
getAccessToken { @Override public String getExactMethod() { return "https://oauth.vk.com/access_token?" + "client_id=" + AppProperty.properties.getProperty("vk.client.id") + "&client_secret=" + AppProperty.properties.getProperty("vk.client.secure.key") + "&redirect_uri=" + AppProperty.properties.getProperty("vk.client.uri.local") + "&code=" + code; } }
where code is already assigned from the last stage, then I send the request itself:
public Object sendGetRequest(SimpleRequest request) { HttpGet postRequest = new HttpGet(request.getUri()); JSONObject vkApiJsonResponse = null; try (CloseableHttpClient httpClient = HttpClientBuilder.create().build(); CloseableHttpResponse response = httpClient.execute(postRequest)){ String json_string = EntityUtils.toString(response.getEntity()); vkApiJsonResponse = new JSONObject(json_string); } catch (Exception e) { FacesContext.getCurrentInstance().addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "Ошибка.", e.getMessage())); } return vkApiJsonResponse; }
which returns a JSON object that contains the token, its lifetime and user_id, here's an example of the return value from my debug

4 - profit! :) I hope it will save someone or a couple of sleepless nights / long days. All good!