Azure AD OAuth 令牌错误的受众（客户端凭据流）

Question

I am trying to get a OAuth token (client_credentials flow) to be able to call my API. I cannot get the proper audience in the token.

In Azure AD, I created 2 App Registration. One to represent my API, the other one to represent my Client.

In my API App Registration, I exposes an API

As you can see in the screenshot I also added my Client App Registration as an "Authorized client applications".

I also added an App Role.

In my Client App Registration, I created a secret to authenticate.

I also added my API App Registration in the "API Permissions" and also Granted Admin Consent.

My problem is when I am trying to get a token from Azure AD. I do the following in Postman:

But the token I get does not contain the audience I specified. It contains the default "Graph API" Audience.

I've been reading on OAuth for the past 2 days but I can't figure out what I am doing wrong.

Also, please note that I cannot use the v2.0 endpoint because in the end, I do all this to be able to authenticate to my API in Power Automate and I don't have the option to use the v2.0 endpoint (and the resource or scope parameters).

Here's the token decoded

Any help will be greatly appreciated.

Answer 1

In summary, I will post it as an answer.

Like I said in the comments, if you are using the OAuth 2.0 protocol, when you use the v1.0 endpoint to request an access token, you should use the resource parameter instead of the audience parameter, because the audience parameter is not recognized by the OAuth 2.0 protocol. Even if you do not selected this parameter in postman, you should be able to obtain a default ms graph api token.

The audience parameter is commonly used in Auth0 organization, but it has some differences from the OAuth 2.0 protocol. The request URL of Auth0 is as follows:

curl --request POST \
  --url 'https://YOUR_DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=YOUR_API_IDENTIFIER