title: InvalidAuthenticationToken when trying to invoke Microsoft Graph client
body: <p>I'm following a sample provided at the Microsoft Graph <a href="https://github.com/microsoftgraph/msgraph-sdk-dotnet/blob/master/docs/overview.md" rel="nofollow noreferrer">repository on github</a>.  In it, it describes using the DelegateAuthenticationProvider which needs an access token.
  Marc LaFleur's <a href="http://massivescale.com/microsoft-v2-endpoint-primer/" rel="nofollow noreferrer">primer on auth flow</a> specified a way to get the access token which I combined with <a href="https://azure.microsoft.com/en-us/documentation/articles/active-directory-protocols-oauth-service-to-service/" rel="nofollow noreferrer">guidance</a> on making service-service authentication work.</p>
  
  <p>Even though I receive what <strong>appears to be a valid access token</strong>, when I issue the command via the graph client, I get a ServiceException from Microsoft Graph stating, </p>
  
  <p>"{
      Code: InvalidAuthenticationToken
      Message: Access token validation failure.
      Inner error
  }"</p>
  
  <p>I haven't seen any other inner error. </p>
  
  <p>What am I doing incorrectly?</p>
  
  <p>This is the code I've come up:</p>
  
  <pre><code>var clientId = "[app-guid]";
  var clientSecret = "[secret-from-app-dashboard]";
  var resource = "[app-guid]";
  var baseUrl = "https://login.microsoftonline.com";
  var loginUrl = "/[tenant guid]/oauth2/token";
  using (var client = new HttpClient())
  {
      client.BaseAddress = new Uri(baseUrl);
      var content = new FormUrlEncodedContent(new[]
      {
          new KeyValuePair&lt;string, string&gt;("grant_type", "client_credentials"),
          new KeyValuePair&lt;string, string&gt;("client_id", clientId),
          new KeyValuePair&lt;string, string&gt;("client_secret", clientSecret),
          new KeyValuePair&lt;string, string&gt;("resource", resource)
      });
      var result = client.PostAsync(loginUrl, content).Result;
      string resultContent = result.Content.ReadAsStringAsync().Result;
      var json = JObject.Parse(resultContent);
  
      accessToken = (string)json["access_token"];
  
  } 
  var header = new AuthenticationHeaderValue("Bearer", accessToken);
  var graphserviceClient = new GraphServiceClient(
  new DelegateAuthenticationProvider(
  (requestMessage) =&gt;
  {
      requestMessage.Headers.Authorization = header;
  
  
      return Task.FromResult(0);
  }));
  try
  {
      var users = await graphserviceClient.Users.Request().GetAsync();
      var user = users.First();
  }
  catch (Microsoft.Graph.ServiceException servex)
  {
      Console.WriteLine(servex);
  }
  </code></pre>