Access token for Microsoft Graph API is immediately expired

Question

I'm following this guide to authenticate to the Microsoft Graph API, and using Postman I can POST to the /token endpoint successfully get a token:

Now, copying that token and pasting it into Authorization: Bearer {{token}}, I try to make a request to https://graph.windows.net/my-tenant/me?api-version=1.6/, but the response I get says

{ "odata.error": { "code": "Authentication_ExpiredToken", "message": { "lang": "en", "value": "Your access token has expired. Please renew it before submitting the request." }, "date": "2018-05-23T08:05:10", "requestId": "f56bcd26-4314-41c6-81b6-e6540aa7b0ae", "values": null } }

How can the token I just created be expired?

juunas · Accepted Answer · 2018-05-23 09:25:08Z

7

I doubt the token is expired, the message seems off.

You are trying to call Azure AD Graph API with a token for MS Graph API. Change your scope to https://graph.windows.net/.default, or call https://graph.microsoft.com/v1.0/me.

Also, you cannot call the /me endpoint after using client credentials flow. There is no signed in user. You have to use /users/object-id-or-upn

edited May 23, 2018 at 9:25

answered May 23, 2018 at 8:14

juunas

59.6k13 gold badges130 silver badges171 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Sa Yang Over a year ago

Use microsoft graph scope token to call AAD graph api is absolutely wrong. But I also think that getting signed user with client credentails flow should not work. It needs user sign in.

Tomas Aschan Over a year ago

Thank you! I had tried changing the endpoint before, but apparently then I had called graph.*windows*.com rather than graph.*microsoft*.com, and when that didn't work I gave that up and tried other things. Now it worked. I also see why /me can't work in this context; the /users endpoint works now, though, so I'm all happy :)

Jos · Accepted Answer · 2021-04-27 20:53:14Z

For others experiencing this issue in the future: this issue also happens if there is a GUID in your initial token request with CAPITAL letters in it. The endpoint will accept and issue a token, but for any resource the comparison breaks. So, use small caps in your guids :)

Collectives™ on Stack Overflow

Access token for Microsoft Graph API is immediately expired

2 Answers 2

2 Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Linked

Related