Hey, I'm getting below error response while hitting the Auth code (POST) api from postman also the api is. https://login.microsoftonline.com/common/oauth2/v2.0/token "error": "invalid_grant", "error_description": "AADSTS70000: The provided value for the 'code' parameter is not valid. The code has expired. Trace ID: 083f67da-bb9e-4778-b8e3-bcdaf5608001 Correlation ID: 3593c6e6-f82f-4405-8a60-de33c270351f Timestamp: 2024-02-25 18:14:22Z", "error_codes": [ 70000 ], "timestamp": "2024-02-25 18:14:22Z", "trace_id": "083f67da-bb9e-4778-b8e3-bcdaf5608001", "correlation_id": "3593c6e6-f82f-4405-8a60-de33c270351f", "error_uri": "https://login.microsoftonline.com/error?code=70000" }

Hi @ asvr asvr The authorization code is not reusable, it expires immediately after use, so do not try to request the /token endpoint with an expired authorization code, you should initiate a new authentication request to obtain a new authorization code. If you want to avoid frequent logins authentication, then you can try using refresh token . Hope this helps. If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment .

The code which is expired is getting from the below request which is also in error state. https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize?client_id={clientId}&response_type=code&redirect_uri={redirect_uri}&response_mode=query&scope=openid profile User.Read Teams.ManageCalls Teams.ManageChats Channel.ReadBasic.All ChannelMessage.Edit ChannelMessage.Send Chat.Create Chat.Read Chat.ReadBasic Chat.ReadWrite ChatMessage.Read ChatMessage.Send Contacts.ReadWrite email offline_access TeamsAppInstallation.ReadForChat User.ReadWrite error - AADSTS50020: User account 'xyz@gmail.com' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application '{clientId}'(app-name) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

invalid_grant in authentication api call

Accepted answer

CarlZhao-MSFT 41,126 Reputation points

2024-02-26T02:54:44.8566667+00:00

Hi @asvr asvr

The authorization code is not reusable, it expires immediately after use, so do not try to request the /token endpoint with an expired authorization code, you should initiate a new authentication request to obtain a new authorization code. If you want to avoid frequent logins authentication, then you can try using refresh token.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.
asvr asvr 20 Reputation points

2024-02-26T07:53:37.4033333+00:00

Okay got you. But the code which I’m getting from the /authorise api is also giving me error. How to resolve it as I have done all the necessary details.

CarlZhao-MSFT 41,126 Reputation points

2024-02-26T08:38:50.1266667+00:00

Hi @asvr asvr

Have you correctly obtained the authorization code in the browser?

asvr asvr 20 Reputation points

2024-02-26T08:47:06.52+00:00

It’s giving me error along with the code.

CarlZhao-MSFT 41,126 Reputation points

2024-02-26T09:12:36.9033333+00:00

Hi @asvr asvr

Can you share the authorization URL you requested and the error details?

asvr asvr 20 Reputation points

2024-02-26T12:29:45.1533333+00:00

@CarlZhao-MSFT Please see below URL and Error.

https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize?client_id={clientId}&response_type=code&redirect_uri={redirect_uri}&response_mode=query&scope=openid profile User.Read Teams.ManageCalls Teams.ManageChats Channel.ReadBasic.All ChannelMessage.Edit ChannelMessage.Send Chat.Create Chat.Read Chat.ReadBasic Chat.ReadWrite ChatMessage.Read ChatMessage.Send Contacts.ReadWrite email offline_access TeamsAppInstallation.ReadForChat User.ReadWrite

error -
AADSTS50020: User account 'xyz@gmail.com' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application '{clientId}'(app-name) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

CarlZhao-MSFT 41,126 Reputation points

2024-02-27T02:27:59.92+00:00

Hi @asvr asvr

Your account is a personal account and it does not exist in the target tenant. Please change /{tenantId} to /common to allow personal account login. Before doing this, please ensure that your application has been configured as a multi-tenant application that allows personal account login.

asvr asvr 20 Reputation points

2024-02-27T08:43:39.0366667+00:00

Okay I have allowed users from any organisation option. that I have to change with. Personal accounts ??

asvr asvr 20 Reputation points

2024-02-27T08:45:06.6966667+00:00

Also I have to replace tenant with common for all the calls ?

CarlZhao-MSFT 41,126 Reputation points

2024-02-27T08:55:03.0666667+00:00

Hi @asvr asvr

Okay I have allowed users from any organisation option. that I have to change with. Personal accounts ??

You need to set the app to: Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox).

Also I have to replace tenant with common for all the calls ?

Yes, you need to replace the tenant Id with common for all calls.

asvr asvr 20 Reputation points

2024-02-27T08:57:11.6633333+00:00

Yes I have selected this option only. Let me hit the api with common in rest end point and will share the response 🙂

asvr asvr 20 Reputation points

2024-02-27T10:09:24.4633333+00:00

CarlZhao-MSFT now I'm getting invalid_scope which is a valid error response from the service for oauth any other scope which is needed for authentication ?

CarlZhao-MSFT 41,126 Reputation points

2024-02-28T02:25:31.2633333+00:00

Hi @asvr asvr

Not all permissions apply to personal accounts, you should request permissions for personal accounts for your multi-tenant app according to the API documentation.

For example, if you want to get the information of the logged in user, you can request the authorization code like this:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={cilent id}&response_type=code&redirect_uri={redirect url}&response_mode=query&scope=openid profile User.Read email offline_access

asvr asvr 20 Reputation points

2024-02-28T09:07:04.63+00:00

Thank you also could you please share the documentation of APIs particularly to send/ retrieve messages to or fro teams as well as to retrieve users in the organisation.

CarlZhao-MSFT 41,126 Reputation points

2024-02-28T09:19:38.96+00:00

Hi @asvr asvr

Personal accounts do not support sending/retrieving messages to teams and retrieving users in an organization because it does not exist in a team or organization. Please use a work account.

CarlZhao-MSFT 41,126 Reputation points

2024-02-28T09:22:11.6833333+00:00

Hi @asvr asvr

If my answer helps you, please don't forget to accept it as answer. Thanks!

asvr asvr 20 Reputation points

2024-02-28T09:31:37.09+00:00

Sure, how can I make the account as work is there any option to do that.

CarlZhao-MSFT 41,126 Reputation points

2024-02-28T09:51:57.1333333+00:00

You simply create a user in a tenant with an enterprise-level Office 365 license, which is the work account.

asvr asvr 20 Reputation points

2024-02-29T10:10:45.38+00:00

Hey Carl is it possible to get teams for free or for trial version

CarlZhao-MSFT 41,126 Reputation points

2024-03-01T01:32:11.59+00:00

Yes, it is possible to get teams using the trial version. Please note that when subscribing to a free trial version of Office 365 license, make sure it supports Teams services.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

invalid_grant in authentication api call

2 additional answers

Your answer