Getting Authentication Access Tokens for Microsoft Apis

In order to use Microsoft Power BI or other Microsoft APIs, you have to obtain an access token, also known as a bearer token. This is because Microsoft uses oAuth2, an industry standard protocol, for authentication. (In other words, a simple API key or username with a password is not enough.)

In this tutorial, we explain how to do that.

(This article is part of our Power BI Guide. Use the right-hand menu to navigate.)

Note: We use curl to post data to Microsoft endpoints. That’s like the command line version of Postman. On Mac and Ubuntu, curl is already there. You might have to install on Windows.

Registering Power BI

If you’re doing all this for the very first time, in order to perform both steps of oAuth2 authentication, there’s a Step 0.

You first have to register your application as a means of getting credentials. You do that one time. This generates an application ID and secret key. For Microsoft Power BI, you do it like this:

First, log into the embedding tool at

This is not the same as logging into Azure and creating an application in Active Directory there. You are creating an application on Power BI’s Azure account (if you want to think of it that way).

Next, fill out the screens below. Note that:

• For the URL, you can use any web page. You will look at the parameters passed to this web page as we show below.
• Skip the screen that says import content.
• For API access, click select all.
• At the end, copy and save the Application ID and Application Secret.

Using oAuth2 for rest APIs

Once you’ve registered, you can move to this step.

Basic authentication is when you need only a user ID and password for access to something.

But Microsoft uses oAuth2 authentication. Microsoft APIs require that you present an Authorization header in order to use the API. Basically, oAuth2 is a two-step process:

1. Do a POST to login.microsoftonline.com
2. Take the access/bearer token from Step 1 and pass that to the API in a header called Authorization for whatever API you are calling.