Obtaining the AD App-Only Token

How to set up an application in Microsoft Entra so your service can get an app-only token, the kind used to sign in to Ejento with no user present. This is usually done by your Entra admin or the developer building the service.

At the end you will have:

an app-only token your service can request whenever it needs one, and

the Application (client) ID and Directory (tenant) ID, which you will enter when registering the application in Ejento.

What to do with the token next is covered in App-Only Token Login.

1. Set up the application

Your service needs an application in your Entra tenant that can sign in as itself, using a client secret, a certificate or a managed identity. Note two of its values:

Value in Entra	Entered in Ejento as
Application (client) ID (for a managed identity, its Client ID)	Application (Client) ID
Directory (tenant) ID	Tenant ID

Use an application that is only used for Ejento. If the same application is also used to
call another API of yours, tokens meant for that API would be accepted by Ejento too.

2. Which token to request

Your service asks Microsoft for a token for its own application: api://<your-client-id>/.default. Use a different value only if Ejento has given you one.

For Microsoft to issue that token, the application must expose an API on itself and be granted an application role on itself, with admin consent. Your Entra admin can set this up in a few minutes.

3. Request the token

Python:

Node:

With a managed identity there is no secret:

If Ejento has given you a different audience, use it in place of api://<your-client-id>. MSAL caches tokens until they expire, so you can call the acquire method on every request.

4. Check the token

A token is three strings joined by dots. Any JWT decoder, such as Microsoft's jwt.ms, shows the middle one as readable JSON. A token that will work with Ejento has:

Claim	Should be
`aud`	`api://<your-client-id>`, or the bare `<your-client-id>`. Either is fine.
`scp`	Absent. If it is present, the token came from a user sign-in, not the app-only flow.
`tid`	Your Directory (tenant) ID
`azp` (v2) or `appid` (v1)	Your Application (client) ID

Do not share the token itself. It is a working credential until it expires. If you need help, share the decoded claims instead.

5. Keep the secret current

Client secrets expire. An expired secret fails at Microsoft with AADSTS7000215: Invalid client secret provided, before the request ever reaches Ejento. Set a rotation reminder, or use a managed identity so there is no secret to rotate. Rotating a secret needs no change in Ejento, because the Application ID stays the same.

Obtaining the AD App-Only Token

1. Set up the application#

2. Which token to request#

3. Request the token#

4. Check the token#

5. Keep the secret current#

1. Set up the application

2. Which token to request

3. Request the token

4. Check the token

5. Keep the secret current