I have a Facebook group as open and I use the following method to return an array with all members of the group:
$group_members = $this->facebook->api("/id_do_grupo/members");
When I change the group to private or secret the array returns empty. It should not, as I am a member of the group and obviously I am authenticated in the app to use facebook- > api.
According to my research I had the following answer:
You can access user and friend permissions. There is a specific user_groups permission. Generally the mode of authentication like Facebook works is that the authentication user will allow your application or (website) access. So if a user is a member of a particular group and allows their application to connect through the user_groups permission, your application will connect successfully.
English - > link
Doc - > link