title: Microsoft Graph API won't work in production
body: <p>I have my site set up so I can use Oauth for single sign on and added access to be able to post calendar entries made on my site to the user's outlook calendar.</p>
  
  <p>Everything works on my dev environment but when I go to my calendar page in production it throws this error:</p>
  
  <blockquote>
    <p><a href="https://graph.microsoft.com/v1.0/me/calendars" rel="nofollow noreferrer">https://graph.microsoft.com/v1.0/me/calendars</a><code>resulted in a</code>401 Unauthorized` response: { "error": { "code": "InvalidAuthenticationToken", "message": "Access token validation failure."</p>
  </blockquote>
  
  <p>I am using the same token I get from oAuth for the calendars. Is that not the right way to do it? And if not how do I go about the right way to do it and why would it work?</p>
  
  <p>here is a part of my oauth page</p>
  
  <pre><code>        // Get an access token using the authorization code grant
      $accessToken = $provider-&gt;getAccessToken('authorization_code', [
          'code'     =&gt; $_GET['code']
      ]);
  
      $_SESSION['refresh_token'] =$accessToken-&gt;getRefreshToken();
      $graph = new Graph();
      $graph-&gt;setAccessToken($accessToken);
      //the sesion token for calendars expires faster than our token to stay in connect, so if it expires have the user sign back in
      try {
        $user = $graph-&gt;createRequest("GET", "/me/calendars")
                      -&gt;execute();
      } catch (Exception $e) {    //FAILS HERE
        // sessionTimeout(); exit; 
        var_dump($e);
      }
  </code></pre>
  
  <p>EDIT</p>
  
  <p>throwing the token i get back into JWT I see that when in development my token has all the information including about what scopes i have. But in production the token is missing the "scp" field. I have no idea what I am doing wrong.</p>
  
  <p>EDIT 2
  I thought maybe I would need a refresh token but that still gives me the same error.</p>