title: On behalf of flow returns AADSTS50013 Assertion failed signature validation. Reason - The key was not found
body: <p>I have a Web API that needs to make calls to Microsoft Graph API on behalf of the user.  I'm using the OBO flow as described <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow" rel="nofollow noreferrer">here</a>.</p>
  <p>To get the access token, I'm posting to</p>
  <pre><code>POST - https://login.microsoftonline.com/&lt;my-tenant-id&gt;/oauth2/v2.0/token
  
  grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
  &amp;client_id=&lt;my-client-id&gt;
  &amp;client_secret=&lt;my-client-secret&gt;
  &amp;assertion=&lt;user's access token&gt;
  &amp;scope=https://graph.microsoft.com/files.readwrite.all
  &amp;requested_token_use=on_behalf_of
  </code></pre>
  <p>The call fails with the following message:</p>
  <pre><code>{
      &quot;error&quot;: &quot;invalid_grant&quot;,
      &quot;error_description&quot;: &quot;AADSTS50013: Assertion failed signature validation. [Reason - The key was not found.]\r\nTrace ID: fb813f8e-ce15-4d09-bbae-9db5e5195a00\r\nCorrelation ID: ecb4e087-5506-4224-8f11-72fbf574beac\r\nTimestamp: 2020-10-22 02:18:57Z&quot;,
      &quot;error_codes&quot;: [
          50013
      ],
      &quot;timestamp&quot;: &quot;2020-10-22 02:18:57Z&quot;,
      &quot;trace_id&quot;: &quot;fb813f8e-ce15-4d09-bbae-9db5e5195a00&quot;,
      &quot;correlation_id&quot;: &quot;ecb4e087-5506-4224-8f11-72fbf574beac&quot;,
      &quot;error_uri&quot;: &quot;https://login.microsoftonline.com/error?code=50013&quot;
  }
  </code></pre>
  <p>Any ideas what I could be doing wrong?</p>
  <hr />
  <p>In response to @Chauncy Zhou,</p>
  <p>I have an Angular app with:</p>
  <p>&quot;@azure/msal-angular&quot;: &quot;^1.0.0&quot;,
  &quot;msal&quot;: &quot;1.3.3&quot;</p>
  <p>In app.module, MSAL is configured something like:</p>
  <pre><code>    MsalModule.forRoot(  
      {  
      auth: {  
        clientId: environment.msClientId,      // app1-client-id  
        authority: environment.msAuthorithy,   // https://login.microsoftonline.com/&lt;tenant-id&gt;  
        redirectUri: environment.msRedirectUri // https://localhost:4200/callback  
      },  
      cache: {  
        cacheLocation: 'localStorage',  
        storeAuthStateInCookie: false  
      },  
    },  
    {  
      consentScopes: ['user.read', 'openid'],  
      protectedResourceMap: [  
        ['https://app-2', ['api://app-2-id/scope-name']],  
      ]  
    }  
  )  
  </code></pre>
  <p>In a test component:</p>
  <pre><code>import { Component, OnInit } from '@angular/core';
  import { MsalService } from '@azure/msal-angular';
  
  @Component({
    selector: 'app-test',
    templateUrl: './test.component.html',
    styleUrls: ['./test.component.scss']
  })
  export class TestComponent implements OnInit {
    constructor(private msal: MsalService) {}
  
    ngOnInit(): void {
      this.msal.acquireTokenSilent({ scopes: ['api://app-2/scope-name'] }).then(response =&gt; {
        console.log(response);
      });
    }
  }
  </code></pre>
  <p>Take the access token from console, and do a POST for OBO in postman.</p>