title: The Access Token Has Been Obtained For the Wrong Audience
body: <p>I'm trying to CRUD Logic App workflows programmatically using the <a href="https://docs.microsoft.com/en-us/rest/api/logic/workflows" rel="nofollow noreferrer">REST API</a>. To do so, I need a JWT attached in the <code>Authorization</code> header of each request.</p>
  <p>I'm trying to set up access between our Azure AD and our Logic App to allow for these operations but cannot seem to get the token to authenticate.</p>
  <p>For resources there is:</p>
  <ul>
  <li>Logic App</li>
  <li>App Registration with a client id/secret</li>
  </ul>
  <p>I've generated an application ID <code>api://X</code> and have used that to generate a token with this request:</p>
  <pre><code>grant_type: client_credentials
  client_id: myClientId
  client_secret: myClientSecret
  scope: api://X/.default
  audience: https://management.azure.com
  </code></pre>
  <p><code>POST</code>ing to:</p>
  <p><code>https://login.microsoftonline.com/app_guid_here/oauth2/v2.0/token</code></p>
  <p>which successfully creates a token, but not one that is accepted. When decoding the token, the <code>aud</code> field is the application ID <code>GUID</code>, which throws the following error when using it to <code>PUT</code> a workflow CRUD operation to the LogicApp REST API:</p>
  <pre><code>{
      &quot;error&quot;: {
          &quot;code&quot;: &quot;InvalidAuthenticationTokenAudience&quot;,
          &quot;message&quot;: &quot;The access token has been obtained for wrong audience or resource 'api://X'. It should exactly match with one of the allowed audiences 'https://management.core.windows.net/','https://management.core.windows.net','https://management.azure.com/','https://management.azure.com'.&quot;
      }
  }
  </code></pre>
  <p>I'm certain that I've missed something here, I'm very new to managing identity this way so frankly I'm a little lost.</p>
  <p>Have I missed a step allowing access to the management API via the app registration? Do I need to add extra permissions elsewhere?</p>
  <p>Frankly all I need is a way to generate these JWTs to authorize requests to the Management API, the specific setup to do so is moot.</p>