Get Access_Token from Microsoft Graph API via cURL

Question

When I run this command in Cygwin per [1] and [2], I get back an Access_Token:

curl -X POST -d 'grant_type=client_credentials&client_id=[myClientId]&client_secret=[myAppSecret]&scope=openid profile User.ReadWrite User.ReadBasic.All Sites.ReadWrite.All Contacts.ReadWrite People.Read Notes.ReadWrite.All Tasks.ReadWrite Mail.ReadWrite Files.ReadWrite.All Calendars.ReadWrite' https://login.microsoftonline.com/[myTenantId]/oauth2/token

When I later try to use that access_token in this trivial query, I get an error:

Access token validation failure. Invalid audience

curl -X GET -H "Authorization: Bearer [accessTokenFromPreviousCommand]" https://graph.microsoft.com/v1.0/me

If I run the https://graph.microsoft.com/v1.0/me query inside Microsoft Graph Explorer, it works correctly. I can also use the Network tab of my internet browser to grab an existing access_token and use that grabbed token in the second cURL command to get back the expected results; however, I have not yet figured out how to successfully take the access_token returned from the first cURL command and use it in the second cURL command.

I did talk to a fellow developer internally about this and he mentioned that I look at [2], but I'm still a bit confused.

Will someone kindly show me what I am doing wrong in the above two cURL commands?

[1] - Mauri, Davide
Calling Azure REST API via cURL
Medium.com
May 4, 2018 [Online]
https://medium.com/@mauridb/calling-azure-rest-api-via-curl-eb10a06127
[Accessed: December 3, 2019]

[2] - Woods, Jackson; Graham, Laura; Guzman, Celeste; Angelgolfer; Wike, Ryan; and possible future contributors
Authentication and Authorization Basics for Microsoft Graph
Microsoft Docs - Microsoft Graph
September 19, 2019 [Online]
https://docs.microsoft.com/en-us/graph/auth/auth-concepts
[Accessed: December 3, 2019]

Answer 1

You cannot use /me when you authenticate with Client Credentials. You need to specify the user by id or userPrincipalName .

When Graph sees /me , it replaces that node with "the id of the currently authenticated user". Since you don't have an authenticated user when you're using Client Credentials, there is no way for Graph to know which user you're looking for.