title: Getting access token to call an API from my ASP.NET Core 5 MVC web app
body: <p>I'm trying to wrap my head around how to properly authenticate a user using Azure Active Directory and OpenID Connect in my ASP.NET Core 5 app, and get the necessary access token so I can make REST requests an to API.</p>
  <p>I have two App Registrations in Azure AD:</p>
  <ul>
  <li>MyAPI - exposes two &quot;scopes&quot; (in &quot;Expose an API&quot;) - one for regular users, one for admins</li>
  <li>MyApp - use the MyAPI as &quot;API permission&quot;</li>
  </ul>
  <p>In my ASP.NET Core 5 MVC app, I have my OpenID Connect set up in my startup:</p>
  <pre><code>        services.AddAuthentication(options =&gt;
              {
                  options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
              })
              .AddCookie()
              .AddOpenIdConnect(options =&gt;
              {
                  options.SignInScheme = &quot;Cookies&quot;;
                  options.Authority = Configuration[&quot;AzureAdConfig:Authority&quot;];
                  options.RequireHttpsMetadata = true;
                  options.ClientId = Configuration[&quot;AzureAdConfig:ClientId&quot;];
                  options.ClientSecret = Configuration[&quot;AzureAdConfig:ClientSecret&quot;];
                  // options.GetClaimsFromUserInfoEndpoint = true;
                  options.ResponseType = OpenIdConnectResponseType.Code;
                  options.UsePkce = true;
                  options.Scope.Add(&quot;offline_access&quot;);
                  options.Scope.Add(&quot;profile&quot;);
                  options.Scope.Add(&quot;api://e968735b-d85e-4359-b364-a9637e4a920d/myapi.data.api&quot;);
                  options.SaveTokens = true;
              });
  </code></pre>
  <p>This appears to work - I can definitely access my authenticated user in the home controller's <code>Index</code> method, and I see all the usual, expected user claims - but I don't see any access token to call &quot;MyAPI&quot;.</p>
  <p>In my MVC app, I have a class to access the API, which uses <code>HttpClient</code> - something like this:</p>
  <pre><code>HttpClient _httpClient = new HttpClient();
  _httpClient.BaseAddress = new Uri(baseUrl);
  
  _httpClient.DefaultRequestHeaders.Clear();
  _httpClient.DefaultRequestHeaders.Add(&quot;Accept&quot;, &quot;application/json&quot;);
  // but where and how can I get this access token I need to call &quot;MyApi&quot; ? 
  _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(&quot;Bearer&quot;, accessToken);
  </code></pre>
  <p>I cannot seem to figure out how to get the access token, either from the original OpenID Connect call, or some other way, in order to provide is as the <code>Bearer (token)</code> auth token to the <code>HttpClient</code> making those calls.</p>
  <p>Any ideas? I've studied sooo many blog post already, and many have outdated information, which makes it really tricky to find proper, current, and working guidance on this....</p>
  <p><strong>Update</strong></p>
  <p>I tried Tore's answer, and first I get an error:</p>
  <blockquote>
  <p>Exception: Correlation failed.<br />
  Unknown location</p>
  <p>Exception: An error was encountered while handling the remote login.
  Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler.HandleRequestAsync()</p>
  </blockquote>
  <p>which seems to have been caused by me not having specified a <code>CallbackPath</code> in my OIDC options.</p>
  <p>So now I do:</p>
  <pre><code>options.CallbackPath = &quot;/localhost:51233/signin-oidc&quot;;
  </code></pre>
  <p>and even though that <strong>exactly</strong> matches one of the defined &quot;Redirect URL&quot; in my Azure App Registration:</p>
  <p><a href="https://i.stack.imgur.com/HJH0H.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HJH0H.jpg" alt="enter image description here" /></a></p>
  <p>now I'm getting <strong>this</strong> error:</p>
  <blockquote>
  <p>AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: '</p>
  </blockquote>
  <p>Also tried with <code>https://localhost:51233...</code> but that didn't make any difference.
  Any further ideas?</p>