how to generate a bearer token for Azure api, with microsoft api

Question

I already managed to get a bearer token with Az cli, but I would like to find another way. I got a bearer token with a request POST to microsoft oauth2 api, but this token doesn't work.

At first, I tried the following request on postman :

Then, I got this token from the request :

I passed this token in the Authorization header for the request : https://dev.azure.com/{organization}/{project}/_apis/git/repositories?api-version=7.0.

The request doest work, with error 401 Unauthorized, and with the message "TF401444: Please sign-in at least once as xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in a web browser to enable access to the service."

Answer 1

Initially, I too got same error when I ran Azure DevOps API call using token generated with wrong resource value like this:

GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories?api-version=7.0

Response:

To resolve the error, you need to change resource value to 499b84ac-1321-427f-aa17-267ca6975798

In my case, I registered one Azure AD application and added it as user in Azure DevOps organization like this:

Now, I generated access token with resource value as 499b84ac-1321-427f-aa17-267ca6975798 via Postman as below:

POST https://login.microsoftonline.com/tenantId/oauth2/token
grant_type:client_credentials
client_id:appId
client_secret:secret
resource:499b84ac-1321-427f-aa17-267ca6975798

Response:

When I used above token to call Azure DevOps REST API, I got the response successfully with project details as below:

GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories?api-version=7.0

Response: