title: Microsoft Graph: Cross-origin token redemption is permitted only for the 'Single-Page Application
body: <p>I would like to Redeem the code for access tokens following the Document <a href="http://%20https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/graph-oauth?view=odsp-graph-online" rel="noreferrer">Authorization and sign-in for OneDrive in Microsoft Graph</a></p>
  <p>This is API that I use for this step</p>
  <p><em>POST <a href="https://login.microsoftonline.com/common/oauth2/v2.0/token" rel="noreferrer">https://login.microsoftonline.com/common/oauth2/v2.0/token</a></em></p>
  <p>I have already tested the API on Postman and it works fine.</p>
  <p>Test Redeem Code on Postman <a href="https://i.stack.imgur.com/f6oVZ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/f6oVZ.png" alt="enter image description here" /></a></p>
  <p>But when I tried on my code JavaScript, I got an error &quot;Cross-origin token redemption is permitted only for the 'Single-Page Application&quot; ,</p>
  <pre><code>{
     &quot;error&quot;:&quot;invalid_request&quot;,
     &quot;error_description&quot;:&quot;AADSTS90023: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type.\r\nTrace ID: 57ebcf82-278c-4375-a4db-b81ab567fc00\r\nCorrelation ID: 5a80b3fa-1e0d-4265-8fbe-5e22df198bee\r\nTimestamp: 2021-04-26 10:26:36Z&quot;,
     &quot;error_codes&quot;:[
        90023
     ],
     &quot;timestamp&quot;:&quot;2021-04-26 10:26:36Z&quot;,
     &quot;trace_id&quot;:&quot;57ebcf82-278c-4375-a4db-b81ab567fc00&quot;,
     &quot;correlation_id&quot;:&quot;5a80b3fa-1e0d-4265-8fbe-5e22df198bee&quot;
  }
  </code></pre>
  <p>So, I tried to fix this problem by add header to allow origin but it doesn't work.
  the following is my coding. my web is hosting on firebase.</p>
  <pre><code>function RedeemToken(){
      var myHeaders = new Headers();
      myHeaders.append(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
      myHeaders.append(&quot;Access-Control-Allow-Methods&quot;, &quot;POST&quot;);
      myHeaders.append(&quot;Access-Control-Allow-Headers&quot;, &quot;Content-Type&quot;);
      myHeaders.append(&quot;Access-Control-Max-Age&quot;, &quot;3600&quot;);
      myHeaders.append(&quot;Content-Type&quot;, &quot;application/x-www-form-urlencoded&quot;);
  
      var urlencoded = new URLSearchParams();
      urlencoded.append(&quot;client_id&quot;, &quot;XXXX&quot;);
      urlencoded.append(&quot;redirect_uri&quot;, &quot;https://XXXX.web.app/LinkToAuthen.html&quot;);
      urlencoded.append(&quot;client_secret&quot;, &quot;XXXX&quot;);
      urlencoded.append(&quot;code&quot;, XXXX);
      urlencoded.append(&quot;grant_type&quot;, &quot;authorization_code&quot;);
  
      var requestOptions = {
        method: 'POST',
        headers: myHeaders,
        body: urlencoded,
        redirect: 'follow'
      };
  
      fetch(&quot;https://login.microsoftonline.com/common/oauth2/v2.0/token&quot;, requestOptions)
        .then(response =&gt; response.text())
        .then(result =&gt; console.log(result))
        .catch(error =&gt; console.log('error', error));
  }
  </code></pre>