"microsoftTeams.authentication.getAuthToken" Failed

Question

I developed a web page hosted in teams app, need to authentication in web.

microsoftTeams.app.initialize().then(() => {
    microsoftTeams.authentication.getAuthToken().then((result) => {
        resolve(result);
    }).catch((error) => {
        reject("Error getting token: " + error);
    });
});

In manifest.json, I configure

"webApplicationInfo": {
        "id": "${{AAD_APP_CLIENT_ID}}",
        "resource": "api://${{TAB_DOMAIN}}/${{AAD_APP_CLIENT_ID}}"
    }

I open the web in teams app:

The result I get is

{"Description":"Recieved an error from AAD. Code: 'invalid_resource' description: '(pii)' correlation id: 'b23ed14c-137a-400e-98c0-d9969662ab1a'","Domain":"com.microsoft.oneauth","ErrorCode":"2002","Message":"Access denied for the resource.","SystemErrorCode":"0","Tag":"965yc","Type":"OneAuth","aad_request_sequence":"1.P","additional_query_parameters_count":"2","all_error_tags":"965yc|965yc|965yc","api_error_code":"0","api_error_context":"Recieved an error from AAD. Code: 'invalid_resource' description: '(pii)' correlation id: 'b23ed14c-137a-400e-98c0-d9969662ab1a'","api_error_tag":"965yc","api_name":"AcquireTokenSilently","api_status_code":"StatusInternal::IncorrectConfiguration","auth_flow":"FRT","auth_flow_last_error":"invalid_resource","authority_type":"AAD","authorization_type":"CachedRefreshToken","broker_app_used":"false","client_id":"1fec8e78-bce4-4aaf-ab1b-5451cc387264","correlation_id":"b23ed14c-137a-400e-98c0-d9969662ab1a","http_call_count":"1","is_successful":"false","last_http_response_code":"400","msal_version":"1.1.0+61e1eea1","original_authority":"https://login.microsoftonline.com/270a8c96-4480-4b5c-954f-c264cee2d33c","prt_enabled":"false","read_token":"ID|ART-8f09e19b2bd57f78|FRT-8f09e19b2bd57f78","request_duration":"558","request_eligible_for_broker":"false-SsoUnavbl","request_id":"a11b7dc0-8afe-40e4-ae1b-6869e0089b01","request_new_prt":"false","server_error_code":"500011","start_time":"2025-02-10T10:24:41.000Z","stop_time":"2025-02-10T10:24:41.000Z","storage_read":"DAC|DID|DAMD|DRT|DRT","was_request_throttled":"false”}

Answer 1

@Jitao Gu - The client_id you see in the error message (1fec8e78-bce4-4aaf-ab1b-5451cc387264) is indeed different from the application client ID you registered in Entra (Azure AD). This client_id is associated with the Microsoft OAuth library, which is used for authentication flows in Microsoft applications

Here are a few steps to troubleshoot and resolve the invalid_client error:

1. Verify Client ID and Secret: Ensure that the client ID and client secret in your application match those registered in Azure AD. Double-check for any typos or mismatches
2. Redirect URI: Make sure the redirect URI in your manifest file matches exactly with the one registered in Azure AD. Any discrepancies can cause authentication issues.
3. Permissions and Scopes: Verify that the necessary API permissions and scopes are granted to your application in Azure AD. Ensure that the permissions are correctly configured and consented to.

Manifest Configuration: Double-check the configuration in your manifest.json file to ensure all URLs and settings are correct.

Network and Firewall: Ensure that there are no network or firewall restrictions blocking the authentication endpoints.

Please refer to the Microsoft identity platform documentation for more detailed guidance on configuring and troubleshooting OAuth 2.0 authorization code flow: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow

Thanks, 

Nivedipa 

-----------------------------------------------------------------------------------------------------------

If the response is helpful, please click "Accept Answer" and upvote it. You can share your feedback via Microsoft Teams Developer Feedback link. Click here to escalate. 

Answer 2

client_id 1fec8e78-bce4-4aaf-ab1b-5451cc387264 is not your application ID it is the ID of Team Mobile/Desktop app and ID 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 is the Teams Web App.

You have to allow Teams ID to access your app. Add the Teams ID (Mobile/Desktop and-or web) to Authorized Client Application (wher you added your application ID).