Hi @Chaya ,
Thanks for reaching out.
I understand you are trying to secure your API with Node.js and Angular login but not able to get the roles in the token to authorize your API.
When you create a web API, you can define custom scopes to restrict access to data and functionality protected by the API. These scopes are used to protect your API endpoints and to ensure that only authorized clients can access them**.**
You can achieve this either using scopes or app roles.
Scope can be created for delegated permissions to access the parts of this API which can request that a user or admin consent to one or more of these scopes.
If you are looking to create application-only scopes, you should use 'App roles' and define app roles assignable to application type**.**
In this scenario where you are trying to call node.js API from single page application (SPA), you would require adding the scope and Expose and API.
You need to expose the API to the client app in Microsoft Entra ID.
1.Expose the API to client apps by adding a scope (in case of delegated permissions).
2.Assign owner to the API which will allow users to own the application and expose themselves to other apps.
Assign permission to your single page application to your API and grant admin consent to the permissions.
You will get the access token with Test.Role scope which can be used as bearer token to authorize the API.
If the goal is to obtain a token for server-to-server authorization, you would need to include roles in the App roles for that scenario.
MSAL sample references - https://learn.microsoft.com/en-us/azure/active-directory/develop/sample-v2-code?tabs=apptype
Hope this will help.
Thanks,
Shweta
Please remember to "Accept Answer" if answer helped you.