This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 55.00000000000001%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
I've been using Azure AD B2C lately and came across this documentation about Azure AD B2C access tokens. This has me wondering if it's possible for users to request access tokens publicly to access APIs, given that they have information such as the client ID of my app registrations. Sorry if this is a silly question, I'm still pretty new to B2C.
Thank you for posting your query on Microsoft Q&A, from above description I could understand that you are looking for way to access an API with access token issued to user account with Azure B2C.
Please do correct me if this is not the case by responding in the comments section.
Yes, you could Secure an Azure API Management API with Azure AD B2C and have it accessed with a B2C user account via an access token issued by B2C endpoint, PFB steps for the same
Thanks,
Akshay Kaushik
Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Hi Akshay-MSFT! I appreciate you trying to answer my question.
My question was more about if individuals can obtain an access token through public means and access my API through that. I have an API that uses B2C and it uses JWT tokens already, but I was just wondering if the tokens are publicly accessible.
Hopefully that makes sense but please let me know if it doesn't and I'll try to clarify my question.
Access tokens are signed, but they aren't encrypted. You must secure your API
to avoid above scenario. When integrating a REST API within an Azure AD B2C user flow, you must protect your REST API endpoint with authentication. The REST API authentication ensures that only services that have proper credentials, such as Azure AD B2C, can make calls to your endpoint.
Thanks,
Akshay Kaushik
Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.