title: Authentication to access other parts of Azure DevOps within a custom task
body: <p>I want to create a Azure DevOps custom task that accesses other parts of Azure DevOps. Specifically, I want to create a custom task that adds a comment to a PR.</p>
  
  <p>Unfortunately, I can't figure out how to authenticate properly. I found this code and added it to my task:</p>
  
  <pre><code>let token: string = tl.getEndpointAuthorizationParameter("SYSTEMVSSCONNECTION", "AccessToken", false);
  let collectionUrl: string = tl.getEndpointUrl("SYSTEMVSSCONNECTION", false).replace(".vsrm.visualstudio.com", ".visualstudio.com");
  let authHandler = token.length === 52 ? vsts.getPersonalAccessTokenHandler(token) : vsts.getBearerHandler(token);
  let connection = new vsts.WebApi(collectionUrl, authHandler);
  </code></pre>
  
  <p>but I get the error:</p>
  
  <blockquote>
    <p>TF401027: You need the Git 'PullRequestContribute' permission to perform this action. Details: identity 'Build\XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX', scope 'repository'.</p>
  </blockquote>
  
  <p>I verified that the build service should have the correct permissions:
  <a href="https://i.stack.imgur.com/o8GAD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/o8GAD.png" alt="enter image description here"></a></p>
  
  <p>I've also tried checking the box "Allow scripts to access the OAuth token" in the Job settings, but that had no effect.</p>
  
  <p>What am I missing?</p>