title: Is it possible to use JWT Bearer received from MSAL (MS identity platform) to access MS AppCenter API?
body: <p>I am writting Android app to call MS Appcenter API (<a href="https://openapi.appcenter.ms/" rel="nofollow noreferrer">https://openapi.appcenter.ms/</a>) and want the users of the app to login with their credential so i can not use pregenerated tokens.</p>
  
  <p>I am able to get JWT token using MSAL android library com.microsoft.identity.client:msal:0.2.2</p>
  
  <p>If I try to call the API "<a href="https://api.appcenter.ms/v0.1/user" rel="nofollow noreferrer">https://api.appcenter.ms/v0.1/user</a>" with <code>Authorization: Bearer ...</code> header I got response <code>{"message":"Fail to verify JWT Token.","statusCode":401,"code":"Unauthorized"}</code></p>
  
  <p>Neither <code>X-API-Token</code> works with the token (not a surprise)</p>
  
  <p>It is interesting if I lookup JWT token from GoogleChrome dev tools and use it either with curl: <code>curl -X GET "https://api.appcenter.ms/v0.1/user" -H "accept: application/json" -H "Authorization: Bearer ..."</code> or hardcode into my android app I get success response.</p>
  
  <p>So it is definitely possible to use "some" JWT token to access Appcenter API, but it is unclear is it possible to get working JWT token from MSAL and what I should use instead it if it is not possible.</p>
  
  <p>My first suggestion is I have to use the correct "SCOPE" audience, but it is not documented and quick guesses did not help</p>
  
  <p>The way I get JWT token from MSAL (have success to get it)</p>
  
  <pre><code>val SCOPES = arrayOf("email")
  
  val authClientApplication = PublicClientApplication(context, clientId)
  
  authClientApplication.acquireToken(
    context,
    SCOPES,
    object:AuthenticationCallback {
                  override fun onSuccess(authenticationResult: AuthenticationResult?) {
                      Log.d(TAG, "Successfully authenticated");
                      Log.d(TAG, "ID Token: " + authenticationResult?.idToken);
                      token = authenticationResult?.idToken
                  }
  ...
  </code></pre>
  
  <p>The way I try to use the JWT token (fails with 401 if JWT got from MSAL)</p>
  
  <pre><code>val client = OkHttpClient()
  val request = Request
              .Builder()
              .header("Authorization", "Bearer "+token)
              .url("https://api.appcenter.ms/v0.1/user")
              .build()
  
          try {
              client.newCall(request).enqueue(object: Callback{
  ...
  </code></pre>
  
  <p>JWT from MSAL decoded content (not-working):</p>
  
  <pre><code>{
    "ver": "2.0",
    "iss": "https://login.microsoftonline.com/XXXXXX-6c67-4c5b-b112-36a304b66dad/v2.0",
    "sub": "AAAAANNNNNAAAAAAAAAAAAJgzlyDKyV8iUg4I-js52sY",
    "aud": "long-numbers-of-azure-app-client-id",
    "exp": 1561271401,
    "iat": 1561184701,
    "nbf": 1561184701,
    "name": "My Name",
    "preferred_username": "my@email",
    "oid": "00000000-0000-0000-cd89-898098098",
    "email": "my@email",
    "tid": "long-numbers-of-something",
    "aio": "BASE64lookingGarbage"
  }
  </code></pre>
  
  <p>JWT from GoogleChrome session decoded content (working):</p>
  
  <pre><code>{
    "id": "35980548-0000-4c1d-9d9c-2318dc17a4a1",
    "origin": "appcenter",
    "iat": 1561184258,
    "exp": 1561187858,
    "aud": "Bifrost",
    "iss": "Heimdall",
    "sub": "user"
  }
  </code></pre>