I have created an app in Azure and given the below permissions to Microsoft Graph. APIConnectors.Read.All Files.Read Files.Read.All Files.ReadWrite.All offline_access User.Read https://graph.microsoft.com/v1.0/me/drive/root/children . I'm making a GET request to list files and folders in one drive root folder. But I'm getting the below error. { "error": { "code": "InvalidAuthenticationToken", "message": "Access token validation failure. Invalid audience.", "innerError": { "date": "2023-03-09T06:01:36", "request-id": "0e614c70-c557-4599-8707-8351352cfcbd", "client-request-id": "0e614c70-c557-4599-8707-8351352cfcbd" } } } Am I doing anything wrong here?

Hi @ Dhruvin Moradiya This indicates that the API audience of your access token is inconsistent with the API endpoint you are calling. When you get an access token, you should set the values of Scope , Auth URL , Access Token URL to: Scope: https://graph.microsoft.com/.default offline_access Auth URL：https://login.microsoftonline.com/common/oauth2/v2.0/authorize Access Token URL：https://login.microsoftonline.com/common/oauth2/v2.0/token Call the Graph API: Hope this helps. If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment .

How to solve InvalidAuthenticationToken error

Accepted answer

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T06:27:01.34+00:00

Hi @Dhruvin Moradiya

This indicates that the API audience of your access token is inconsistent with the API endpoint you are calling.

When you get an access token, you should set the values of Scope, Auth URL, Access Token URL to:

Scope: https://graph.microsoft.com/.default offline_access

Auth URL：https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Access Token URL：https://login.microsoftonline.com/common/oauth2/v2.0/token

Call the Graph API:

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.

1 person found this answer helpful.
Dhruvin Moradiya 55 Reputation points

2023-03-09T06:56:01.1266667+00:00

Hey, @CarlZhao-MSFT Thank you for your response.
Still getting the same error

{ "error": { "code": "InvalidAuthenticationToken", "message": "Access token validation failure. Invalid audience.", "innerError": { "date": "2023-03-09T06:56:36", "request-id": "2155e05d-bec5-4f7c-9b30-28a11f51ece4", "client-request-id": "2155e05d-bec5-4f7c-9b30-28a11f51ece4" } } }

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T06:58:17.6833333+00:00

Hi @Dhruvin Moradiya

Use jwt.ms to parse your access token and share screenshots.

Dhruvin Moradiya 55 Reputation points

2023-03-09T07:01:07.82+00:00

Removed The Image

Here.

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T07:10:13.89+00:00

Hi @Dhruvin Moradiya

The 00000002-0000-0000-c000-00000000000000 is the audience of the Windows Azure AD graph api and not the audience of the MS graph api, how do you set the values of the Auth URL and Access Token URL?

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T07:26:01.01+00:00

Hi @Dhruvin Moradiya

You should set the values for Auth URL and Access Token URL to:

Auth URL：https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize

Access Token URL：https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/token

Dhruvin Moradiya 55 Reputation points

2023-03-09T07:33:26.7066667+00:00

Hi @CarlZhao-MSFT

AuthURL : https://login.microsoftonline.com/common/oauth2/authorize

Token URL : https://login.microsoftonline.com/common/oauth2/token
What changes should I make to use list files in one drive using graph API?

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T07:39:10.9966667+00:00

Hi @Dhruvin Moradiya

Do you want to list all files in driveItem?

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T07:42:53.05+00:00

Hi @Dhruvin Moradiya

I noticed that you are using the /common endpoint, is your app multi-tenant app? Do you want to access OneDrive of the another organization?

Dhruvin Moradiya 55 Reputation points

2023-03-09T07:46:36.8833333+00:00

Hi @CarlZhao-MSFT
Yes. It is a multi-tenant app. Building applications to access files from drives outside our organization as well. Currently, I'm making calls to my personal drive.
I have selected Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) while creating the app.

Yes. I want to make API calls to one drive.
List files, folders, edited files after given datetime, deleted files, etc.

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T07:57:34.3333333+00:00

Hi @Dhruvin Moradiya

So what you're doing is the right, you just need to change /{tenant id} to /common, and log in with your personal account.

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T08:03:07.7+00:00

Hi @Dhruvin Moradiya

I made some updates to the answer, if my answer is helpful to you, please don't forget to accept it as an answer, thank you very much!

Dhruvin Moradiya 55 Reputation points

2023-03-09T08:04:37.28+00:00

Hi @CarlZhao-MSFT

AuthURL : https://login.microsoftonline.com/common/oauth2/authorize

Token URL : https://login.microsoftonline.com/common/oauth2/token
Do you mean /common to /{tenant_id} ?

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T08:10:01.84+00:00

Hi @Dhruvin Moradiya

No, it's /{tenant_id} to /common.

Dhruvin Moradiya 55 Reputation points

2023-03-09T08:12:11.5866667+00:00

Hi @CarlZhao-MSFT
it's was set to /common from the very start.

CarlZhao-MSFT 42,211 Reputation points

2023-03-09T08:15:58.8366667+00:00

Hi @Dhruvin Moradiya

So your problem still exists? I've tested it locally and it works fine.

Dhruvin Moradiya 55 Reputation points

2023-03-09T08:57:45.8133333+00:00

Hey @CarlZhao-MSFT

Thank you for your Help. I did some google search, and I found out that We can't use the MS Graph API if we have MS Home License associated with our account. We need a business account to use ms graph API. I switched to a business account (Created an App using a business Account ), and it worked.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to solve InvalidAuthenticationToken error

0 additional answers

Your answer