Authentication dataverse without library

Question

Hi!

I need to connect to the Microsoft Dataverse API with OAuth 2.0 authentication with certificate. (S2S)

Not using a MSAL library.

Where can I find the code to collect the token?

Answer 1

Hi Laura,

Yes, you can get the Dataverse access token without using MSAL or another authentication library. You need to implement the OAuth 2.0 client credentials flow with a certificate yourself.

The flow is:

Register an app in Microsoft Entra ID and upload the public certificate.

Create a signed JWT client assertion using the certificate's private key.

POST that assertion to the Entra token endpoint:

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={client-id}
scope=https://{org}.crm.dynamics.com/.default
grant_type=client_credentials
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion={signed-jwt}

The JWT needs the required claims such as aud, iss, sub, jti, nbf, and exp, and must be signed with the registered certificate. Microsoft documents the exact certificate assertion format here.

The response will contain an access_token, which you can send to Dataverse as:

Authorization: Bearer <access_token>

For example:

GET https://{org}.crm.dynamics.com/api/data/v9.2/accounts
Authorization: Bearer <access_token>
Accept: application/json

One thing to keep in mind: although this can be done manually, Microsoft recommends using a supported identity library where possible because creating and signing the client assertion yourself means you also have to correctly handle certificate keys, JWT signing, token renewal, and caching.

For a specific language such as C#, Python, Java, or PowerShell, the implementation is different.