Errors authenticating with a Public Client Application

[Anonymous]

Hello all,

I'm learning how to use the Power BI REST API. I am using the MSAL library to authenticate my desktop application, and I am using the below function to create a bearer token:

def getBearerToken():
    client_id = os.environ.get("CLIENT_ID")
    client_secret = os.environ.get("CLIENT_SECRET")
    tenant_id = os.environ.get("TENANT_ID")
    scope = ['https://analysis.windows.net/powerbi/api/.default']
    authority_url = "https://login.microsoftonline.com/" + tenant_id


    app = msal.PublicClientApplication(client_id, authority=authority_url)
    response = app.acquire_token_interactive(scopes=scope, port=5000)

    return response['access_token']

I am successfully creating a bearer token after logging in with my account. However, when I try to run a simple API call, I keep getting a 401 error. Below is the API call I am making:

token = getBearerToken()
endpoint = "https://api.powerbi.com/v1.0/myorg/groups"

headers = {"Content-type": "application/json", "Authorization": f"Bearer {token}"}

r = requests.get(endpoint, headers=headers)

print(r.status_code)
print(r.content)

Instead of getting the workspaces I am in, I instead get a 401 error with nothing inside the response body. Any ideas what I need to change in the Azure Portal, or my API calls?

Thanks,

Taha

[Anonymous · Accepted solution]

I realized that I needed to specify the actual scopes of the application, rather than leaving it at default. Once I did that, everything authenticated as expected.

[Anonymous]

Hi, @Anonymous 

Regarding the issue you raised, my solution is as follows:

1.First, check the permissions: Make sure you have the correct permissions assigned to the application in the Azure portal. You'll need to give your application permission to Read and write everything in the Power BI service.
 

2.Second, you can try to validate the token first: make sure that the token you get contains the correct permissions. You can use tools like JWT.io to decode the token and check the permission claims in it.

The following documents are what we hope will help you:

JSON Web Token Introduction - jwt.io
 
Of course, if you have any new ideas, you are welcome to contact us.
 

Best Regards,

Leroy Lu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.