It looks like you're mixing a couple of the OAuth steps. You should start the OAuth exchange with a redirect to a URL something like

string url = "https://login.salesforce.com/services/oauth2/authorize?" + 
    "response_type=code&client_id=" + key + 
    "&redirect_uri=http%3A%2F%2Flocalhost%3A1670%2Fmyservice.svc%2Fcallback";

Note that the redirect URI is URL encoded.

This will take the user to the the login page to authenticate and then authorize the application. Salesforce will redirect the browser back to the redirect URI with a code parameter - this is the OAuth authorization code. You should then POST the authorization code back to https://login.salesforce.com/services/oauth2/token to obtain the access token, instance URL etc. The POST body will be something like

string postData = "code=" + code + "&client_id=" + key + "&client_secret=" + secret + "&redirect_url=http://localhost:1670/myservice.svc/callback" + "&grant_type=authorization_code";

You'll get a JSON-encoded response of the form:

{
	"id":"https://login.salesforce.com/id/00D50000000IZ3ZEAW/00550000001fg5OAAQ",
	"issued_at":"1296458209517",
	"refresh_token":"5Aep861eWO5D....",
	"instance_url":"https://na3.salesforce.com",
	"signature":"0/1Ldval/TIPf2tTgTKUAxRy44VwEJ7ffsFLMWFcNoA=",
	"access_token":"00D50000000IZ3Z!AQ0AQDpEDKYs..."
}

You should also take a look at Getting Started with the Force.com REST API - it has a complete worked example in Java, which you can probably adapt to your purposes.

Let us know how you get on...

Is there a way to circumvent user authorization?

Since this is middleware between a third-party application and salesforce, there won't be a user to do the authorization.

When setting up Remote Access in my salesforce account, there's a checkbox for "No user approval required". Can this circumvent the user based authorization?

Thanks!

If your app is not interactive, it can authenticate directly with username/password, posting a payload like this to https://login.salesforce.com/services/oauth2/token :

string postData = "grant_type=password&client_id=" + key + "&client_secret=" + secret + "&username=" + username + "&password=" + password;

Note that in Winter '11 (the current version) you will need to whitelist your IP address. In Spring '11 (coming soon), you can append the API security token to the password and get a token without the whitelisting.

See this thread for much more discussion of getting a token from username/password.

Note also, this method should only be used in server-to-server integration - don't ever distribute code containing secrets and passwords.