Hi @MOUSSAOUI Mohammed
It depends on which API you want to call.
If you want to call the SharePoint REST API, then keep the current script unchanged and pass a token with an audience for the SharePoint REST API.
When obtaining the token, you need to change the scope to:
POST /{tenant}/oauth2/v2.0/token HTTP/1.1 //Line breaks for clarity
Host: login.microsoftonline.com:443
Content-Type: application/x-www-form-urlencoded
client_id=00001111-aaaa-2222-bbbb-3333cccc4444
&scope=https://{tenant-name}.sharepoint.com/.default
&client_secret=qWgdYAmab0YSkuL1qKv5bPX
&grant_type=client_credentials
Please note that you need to grant your application the corresponding SharePoint REST API permissions in Azure AD, not the Graph API permissions.
If you want to call the Graph API, then keep the original token unchanged and modify your script as follows.
const graphUrl = "https://graph.microsoft.com";
const siteId = "xxxxxxxxxxxxxxxx";
const itemId = "xxxxxxxxxxxxxxxxx";
const accessToken = '{MS Graph API token}';
const response = await fetch(`${graphUrl}/sites/'${siteId}'/drive/items/'${itemId}'`)
By the way, I’m not a JS expert, so you might need to make some other changes to your JS based on the actual call.
Additionally, if you want to know which API your token belongs to, you can decode the current token using jwt.ms and check the aud claim.