How to connect custom API using own OAuth2 in Microsoft Power Automate?

0
votes

I've been trying to connect Microsoft Power Automate to my API. My API has a OAuth2 Code Flow. According to Power Automate, the connector can make a connection to my API. and execute a test. But the problem is that Microsoft sends a Bearer token that was generated by them, and not the one that I gave to them via OAuth2, resuting on my API giving a 401 Error (Invalid Token) as expected.

In the Power Automate Custom Connector page, in the security tab I have the following:

Authentication type

OAuth2.0

OAuth2.0 Settings

  • Identity Provider: Generic OAuth2
  • Client ID: SomeValue
  • ClientSecrect: SomeValue
  • Authorization URL: mydomain.com/auth/authorize
  • Token URL: mydomain.com/auth/token
  • Refresh URL mydomain.com/auth/token
  • Redirect URL: microsoft-flow.com/redirect (Not the real one)

When Microsoft makes a POST request to mydomain.com/auth/token, I return the following body:

{
access_token: "non JWT token", // simillar to a hash
refresh_token: "non JWT token",
expires_in: 3600
}

The request above is final request that microsoft before accepting as a valid connection. The token that microsoft sends me is a JWT one, not the one I provided.

I've seen some guys using Azure AD authentication within the APP, but I was trying to implement something simillar to other platoforms(e.g Github, Spotify, e.t.c)

So my question is it possible to connect Power Automate to a custom API with using OAuth2? If yes, how to do it?

2
oauth-2.0azure-active-directorypower-automate

2 Answers

1
votes

It's possible.

In addition to the OAuth2.0 Settings you listed, there is another important property Scope which you have missed.

Since your API is protected in Azure AD, so I assume that you have created an Azure AD app for your API and exposed scopes.

After that, you can get the application ID URI (api://{clientId}) for your API.

You should put this value into the "Scope" in Power Automate, like this:

enter image description here

Then this access token will be considered valid by your API.

0
votes

I've done two steps to fix this problem.

Step 1

Previously my API returned the body with access_token, refresh_token and expires_in, but then I added scope and token_type. Example:

{
  access_token: "2346ad27d7568ba9896f1b7da6b5991251debdf2",
  refresh_token: "4468e5deabf5e6d0740cd1a77df56f67093ec943",
  expires_in: 3600,
  scope: "none",
  token_type: "Bearer"
}

Step 2

Delete the custom connector and create a new one with the same parameters. When I got to the "Test" section, Power automate finally could make the GET request successfully.

In my case, even if the the API was updated, Power automate was still using its faulty token, so I had to delete that custom connector and create new one.

Conclusion

By updating the API and deleting the old custom connector, I was able to get the connector working.