Okay, I got it now. I was thinking that you had to use OAuth to get a session token, which you do not have to do.
Each call to the REST API authenticates itself with the code that you've already provided. Cool.
I have whipped up a handful of C# objects which read the resulting XML from a couple of calls. They are very minimal and do no error ...