I have been using msal to log users into the app using the acquireTokenSilent call and that works perfectly fine. I am able to get the response token which contains things like the accessToken and idToken among other things. but when trying to use the graph api to get the account photo by using any of these tokens in the the bearer header I get a 401 error. I am calling it correctly because by using the token shown here in the graph explorer it works fine.
Essentially my question is, how do I get this access token to call the graph api.
I am trying to do this in a web app using JavaScript.
axios.get("https://graph.microsoft.com/v1.0/users/" + this.username + "/photos/48x48/$value", {
headers: {
Authorization:
"Bearer " +
"insertTokenHere"
},
responseType: "blob"
})
.then(response => {
Couple of things to make it work -
Based on authorization protocol, obtain bearer tokens to access endpoints. Refer documentation here if you are using authorization code flow.
Scope parameter is required which is nothing but a space-separated list of scopes that you want the user to consent to. Make sure you understand the necessary permissions for each of the API endpoint. Necessary permissions for each API endpoint are documented in ms docs. Refer for an example here.
Also, ensure admin has consented wherever needed.
Thanks.