Authorization gets failed when making yammer API calls using AAD tokens generated with grant_type="client_credentials"

Question

I am getting 401 unauthorized issue when trying to make yammer API calls mentioned here. I have created an app from app registrations on Azure portal and provided below permissions And I have used post method to generate token using below parameters:

Access Token URL: https://login.microsoftonline.com/organizations/oauth2/v2.0/token

Client ID: {App client ID}

Secret: {App client secret}

Scope: https://api.yammer.com/.default

GrantType : client_credentials

Using above post request I am able to generate token but with this token I am not able to authorize yammer API calls

But I am able to authorize yammer API calls and able to get response back successfully when I have generated bearer token with grant_type='authorization_code',

scope='https://api.yammer.com/user_impersonation',

redirect_uri='http://localhost',

Auth endpoint='https://login.microsoftonline.com/{tenant ID}/oauth2/v2.0/authorize',

Client ID: {App client ID},

Secret: {App client secret} But GrantType : authorization_code always prompt us for user credentials. So, to avoid this I have used 'client_credentials' but it get fails at authorization.

Could any one help me how to authorize yammer API calls using AAD tokens with GrantType : client_credentials or any other way to make yammer API calls successfully with out prompting for user credentials?

Answer 1

@DivyaP, what you are trying to does not seem possible. The Yammer API does not support the Client Credentials (App-only) OAuth flow. The tip to me was the lack of Application permissions in Azure when attempting to add Yammer scopes as described in this article. https://techcommunity.microsoft.com/t5/yammer-blog/yammer-api-with-aad-tokens-postman-collection/ba-p/857923

As a possible option to address your use of an app once the tokens are received (which you seem to have completed), you can persist the access and refresh tokens and then refresh as needed with the refresh token. I went through similar issues with the LinkedIn API recently. Parts of the LinkedIn API do not support app-only access so I had to log in as a user, approve the app and scopes, persist the token and use the refresh token as needed. See https://peteskelly.com/authenticating-linkedin-users-using-asp-net-contrib-oauth-providers/. The ASPNET-Contrib Providers project has a Yammer provider so this scenario might work for you as well.

Perhaps someone with more knowledge of Yammer specifically can confirm that Yammer does not support true client credentials flows.