title: MSAL and passporrt-azure-ad cannot verify token
body: <p>I have not been able to link the Azure Active Directory access control in our ReactJS application to our API, and reading through the documentation on this matter has left me with more questions than answers.</p>
  <p>I first began by following the instructions in the AAD <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-spa-overview" rel="nofollow noreferrer">Single-page app</a> scenario, which was straightforward and allowed me to log in to my AAD account on the web, which I mentioned previously.  That worked well.</p>
  <p>However, when it came to configuring our NodeJS API, I was presented with two options: <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-call-api-overview" rel="nofollow noreferrer">A Web app that calls web APIs</a>, and <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-overview" rel="nofollow noreferrer">Protected web API</a>.</p>
  <p>In A Web app that calls web APIs, the registration was straightforward and led me to believe that this was the way to go, however the Code Configuration page states that only ASP, Java, and Python are supported.  I was unable to find any JavaScript examples for this scenario, so I moved on to Protected Web API.</p>
  <p>Similarly, while I found the registration portion to be easy to follow, the Code Configuration page only listed examples in .NET, NodeJS (but only for App Functions, rather than a standalone API), and Python.  Given that the NodeJS example was close enough to a standalone API, I followed along with that code, substituting our configuration options where appropriate, seeing as it used the <a href="https://www.npmjs.com/package/passport-azure-ad" rel="nofollow noreferrer">passport-azure-ad</a> package that I saw elsewhere and previously had tried to implement.  However, in both cases, every attempt to make an API call against the protected endpoint resulted in the API logging the following:</p>
  <p>“authentication failed due to: In Strategy.prototype.jwtVerify: cannot verify token”</p>
  <p>Additionally, and I’m not sure how related this could be, but I noticed that when I decoded the ID Token and Access Token on the ReactJS application, the ID Token version was 2.0, but the Access Token was 1.0.  Searching through Github Issues and StackOverflow showed that others had observed this behavior as well, although I was unable to replicate their processes in order to get a v2.0 Access Token, which I suspect but am not sure is the reason for the inability for the NodeJS API to verify the token.</p>
  <p>Oh, and I have observed the same behavior when using MSAL.js 1.3 as well as the 2.0 beta in the client, in case that helps.</p>