title: POSTMAN: "You do not have permission to view this directory or page" with Bearer Token
body: <p>I've got a website hosted on HostGator, let's say it's domain is <code>https://example.com</code>.</p>
  
  <p>I also have an application hosted on Azure, with <code>Active Directory</code> Authentication enabled on the entire site (including the API component), let's say it's domain is <code>https://example.azurewebsites.net</code></p>
  
  <p><strong>THE GOAL -</strong> To have a PHP file be executed (as a CRON job) on <code>https://example.com</code> and have the file first Authenticate itself with Azure's Active Directory, and then to pull data from <code>https://example.azurewebsites.net/api/getValues</code> via an HTTP <code>GET</code> call.</p>
  
  <p><strong>THE PROBLEM -</strong> Obviously, just calling the API without a bearer token will cause a <code>401</code>, but I'm still getting a <code>401</code> even though I'm passing in what appears to be a valid Bearer Token.</p>
  
  <p>Here's what I did:</p>
  
  <p>Using <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-code</a> -</p>
  
  <p>I visited <code>https://login.microsoftonline.com/{{tenant_id}}/oauth2/authorize?response_type=code&amp;client_id={{client_id}}</code> that was given to me through Azure AD Management Portal.</p>
  
  <p>This returned:</p>
  
  <p><code>https://example.com/?code={{really_long_string_of_code}}</code></p>
  
  <p>I took this <code>really_long_string_of_code</code> and put it through postman as a body parameter called <code>code</code>, seen below:</p>
  
  <p><a href="https://i.stack.imgur.com/KSip8.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/KSip8.jpg" alt="PostMan-token-retrieval"></a></p>
  
  <p>As you can see, it returned the token seen above ^.</p>
  
  <p>I then took this token and put it through another <code>Postman</code> call:</p>
  
  <p><a href="https://i.stack.imgur.com/VYCci.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/VYCci.jpg" alt="postman-call"></a></p>
  
  <p>But the problem is, I still get that exact error message:</p>
  
  <blockquote>
    <p>You do not have permission to view this directory or page.</p>
  </blockquote>
  
  <p>I feel like I've tried everything. I've even went into the <code>portal.azure</code> and set the "allowed token audiences":</p>
  
  <p><a href="https://i.stack.imgur.com/X44UA.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/X44UA.jpg" alt="Azure-portal-settings"></a></p>
  
  <p>Anyone know any settings I can change to allow this sort of call to happen?</p>