I had the same problem. According to this , Microsoft doens't like the Access Token to be retrieved from client side. Hence, I followed this to solve the issue. Basically, build a call in back end WebAPI to retrieve the access token by passing the Authorization code.