How to solve InvalidAuthenticationToken error

2023年9月1日 Will

I have created an app in Azure and given the below permissions to Microsoft Graph.

APIConnectors.Read.All
Files.Read
Files.Read.All
Files.ReadWrite.All
offline_access
User.Read

https://graph.microsoft.com/v1.0/me/drive/root/children. I’m making a GET request to list files and folders in one drive root folder. But I’m getting the below error.

{
    "error": {
        "code": "InvalidAuthenticationToken",
        "message": "Access token validation failure. Invalid audience.",
        "innerError": {
            "date": "2023-03-09T06:01:36",
            "request-id": "0e614c70-c557-4599-8707-8351352cfcbd",
            "client-request-id": "0e614c70-c557-4599-8707-8351352cfcbd"
        }
    }
}

Am I doing anything wrong here?

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 4:41 PM

Hi @Dhruvin Moradiya

I am checking to see if this issue is resolved or not. If you have any concerns, please feel free to reply.

Accepted answer

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 2:27 PM

Hi @Dhruvin Moradiya

This indicates that the API audience of your access token is inconsistent with the API endpoint you are calling.

When you get an access token, you should set the values of Scope, Auth URL, Access Token URL to:

Scope: https://graph.microsoft.com/.default offline_access

Auth URL：https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Access Token URL：https://login.microsoftonline.com/common/oauth2/v2.0/token

Call the Graph API:

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.

1 person found this answer helpful.
Dhruvin Moradiya35Reputation points

Mar 9, 2023, 2:56 PM

Hey, @CarlZhao-MSFT Thank you for your response.
Still getting the same error

{ "error": { "code": "InvalidAuthenticationToken", "message": "Access token validation failure. Invalid audience.", "innerError": { "date": "2023-03-09T06:56:36", "request-id": "2155e05d-bec5-4f7c-9b30-28a11f51ece4", "client-request-id": "2155e05d-bec5-4f7c-9b30-28a11f51ece4" } } }

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 2:58 PM

Hi @Dhruvin Moradiya

Use jwt.ms to parse your access token and share screenshots.

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 3:01 PM

Removed The Image

Here.

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 3:10 PM

Hi @Dhruvin Moradiya

The 00000002-0000-0000-c000-00000000000000 is the audience of the Windows Azure AD graph api and not the audience of the MS graph api, how do you set the values of the Auth URL and Access Token URL?

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 3:26 PM

Hi @Dhruvin Moradiya

You should set the values for Auth URL and Access Token URL to:

Auth URL：https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize

Access Token URL：https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/token

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 3:33 PM

Hi @CarlZhao-MSFT

AuthURL : https://login.microsoftonline.com/common/oauth2/authorize

Token URL : https://login.microsoftonline.com/common/oauth2/token
What changes should I make to use list files in one drive using graph API?

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 3:39 PM

Hi @Dhruvin Moradiya

Do you want to list all files in driveItem?

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 3:42 PM

Hi @Dhruvin Moradiya

I noticed that you are using the /common endpoint, is your app multi-tenant app? Do you want to access OneDrive of the another organization?

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 3:46 PM

Hi @CarlZhao-MSFT
Yes. It is a multi-tenant app. Building applications to access files from drives outside our organization as well. Currently, I’m making calls to my personal drive.
I have selected Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) while creating the app.

Yes. I want to make API calls to one drive.
List files, folders, edited files after given datetime, deleted files, etc.

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 3:57 PM

Hi @Dhruvin Moradiya

So what you’re doing is the right, you just need to change /{tenant id} to /common, and log in with your personal account.

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 4:03 PM

Hi @Dhruvin Moradiya

I made some updates to the answer, if my answer is helpful to you, please don’t forget to accept it as an answer, thank you very much!

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 4:04 PM

Hi @CarlZhao-MSFT

AuthURL : https://login.microsoftonline.com/common/oauth2/authorize

Token URL : https://login.microsoftonline.com/common/oauth2/token
Do you mean /common to /{tenant_id} ?

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 4:10 PM

Hi @Dhruvin Moradiya

No, it’s /{tenant_id} to /common.

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 4:12 PM

Hi @CarlZhao-MSFT
it’s was set to /common from the very start.

CarlZhao-MSFT27,206Reputation points

Mar 9, 2023, 4:15 PM

Hi @Dhruvin Moradiya

So your problem still exists? I’ve tested it locally and it works fine.

Dhruvin Moradiya35Reputation points

Mar 9, 2023, 4:57 PM

Hey @CarlZhao-MSFT

Thank you for your Help. I did some google search, and I found out that We can’t use the MS Graph API if we have MS Home License associated with our account. We need a business account to use ms graph API. I switched to a business account (Created an App using a business Account ), and it worked.
Sign in to comment