Forum Discussion
App only authentication - oAuth2 token request
Hi everyone
I'm making use of app-only authentication (the app owns data method), I've already set up a new group and created a service principle, as well as enabled the "Allow service principle to use Power BI Apps" option in Power BI, where I added the group to as well.
I've followed some online videos and from my understanding, this service principle should now be able to make user-related calls. The idea is to get dashboard and report embeds using the app / service principle that was created and given access to.
My question is how do I perform the oauth token request with the app id and secret I have? The app in question is a web app, and I have a linux machine so can't run the c# examples, I'm yet to see a simple Curl / php example of authenticating.
I'm trying to set this up in Postman, but I'm not sure which grant type and scope to use, could someone please help point me in the right direction of how to actually authenticate as the app / service principle with the token endpoint provided for the app?
Thanks
Hi ricus_zero you can use the below query in postman, basically you should use the grant type as client_credentials
resource:https://analysis.windows.net/powerbi/api
client_id:xxxxx
client_secret:xxxx
grant_type:client_credentials
9 Replies
Hi ricus_zero you can use the below query in postman, basically you should use the grant type as client_credentials
resource:https://analysis.windows.net/powerbi/api
client_id:xxxxx
client_secret:xxxx
grant_type:client_credentialsHi Jayendran
Thanks for the prompt response!
I noticed your token endpoint is the v1 endpoint and not the /oauth2/v2.0/token one, is there a reason for that?
That screenshot helped a lot, I was able to get an access token using the token endpoint you used (not v2), but the same does not work for v2, do you know why this might be?
Regardless, after I got the access token I attempted getting a list of reports making a GET request to https://api.powerbi.com/v1.0/myorg/reports - but I'm getting the following response:
The app is part of a group to which I have given access inside of the tenant settings in PowerBI, am I missing something?
I'd like to mention again the end result here is for me to get embed urls for reports and dashboards, I think the endpoint I was checking is what I need but I might be wrong.
I noticed this section in the documentation regarding embed tokens, but that requires scopes that we did not supply with the token request?
Thanks again for the help
Hi ricus_zero
As per microsoft they used v1. So It's a standard for us to use V1 whenever we login using microsoft.
Coming back to your error..
Actually you are calling a API https://api.powerbi.com/v1.0/myorg/reports which is My Workspace This is the default workspace given to your account by PowerBI.
SPN won't able to access My Workspace, because you can only able to access it, not a service account/SPN.
What you can do now ?
- Create a new workspace
- Add the SPN as the Admin to the new workspace
- Publish the report in that workspace
- Call the REST API GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId} which the SPN token
Hi Jayendran
Once again coming in with the rock solid response.
Now that you mention it that makes a lot of sense, so in essence, we would require a pro account because only pro accounts can create new workspaces?
For the time being, I've enabled the trial pro account to test this out.
I created a new workspace, when it comes to assigning the service principle as admin to the new workspace, It's not picking it up in the auto complete? Is this feature available on the gui yet? (I remember from a video I watched, that a few months back this wasn't possible from the interface and the SPN had to be added via PowerShell)
For reference, I have a group called Power BI Apps, which has been added under tenant settings:
In Azure AD when I navigate to this group and click on members, I can see the service principle there
When attempting to add this it's not picked up, is this because it's not possible from the gui?
Regards
