2

I'm following this guide to authenticate to the Microsoft Graph API, and using Postman I can POST to the /token endpoint successfully get a token:

post to get token

Now, copying that token and pasting it into Authorization: Bearer {{token}}, I try to make a request to https://graph.windows.net/my-tenant/me?api-version=1.6/, but the response I get says

{
    "odata.error": {
        "code": "Authentication_ExpiredToken",
        "message": {
            "lang": "en",
            "value": "Your access token has expired. Please renew it before submitting the request."
        },
        "date": "2018-05-23T08:05:10",
        "requestId": "f56bcd26-4314-41c6-81b6-e6540aa7b0ae",
        "values": null
    }
}

How can the token I just created be expired?

2 Answers 2

7

I doubt the token is expired, the message seems off.

You are trying to call Azure AD Graph API with a token for MS Graph API. Change your scope to https://graph.windows.net/.default, or call https://graph.microsoft.com/v1.0/me.

Also, you cannot call the /me endpoint after using client credentials flow. There is no signed in user. You have to use /users/object-id-or-upn

2
  • 1
    Use microsoft graph scope token to call AAD graph api is absolutely wrong. But I also think that getting signed user with client credentails flow should not work. It needs user sign in.
    – Wayne Yang
    May 23, 2018 at 9:22
  • 2
    Thank you! I had tried changing the endpoint before, but apparently then I had called graph.*windows*.com rather than graph.*microsoft*.com, and when that didn't work I gave that up and tried other things. Now it worked. I also see why /me can't work in this context; the /users endpoint works now, though, so I'm all happy :) May 23, 2018 at 9:35
0

For others experiencing this issue in the future: this issue also happens if there is a GUID in your initial token request with CAPITAL letters in it. The endpoint will accept and issue a token, but for any resource the comparison breaks. So, use small caps in your guids :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.