How to fix invalid request

The app registration and token flow must match the component redeeming the authorization code: a browser SPA must use the Single-page application platform with PKCE, while an App Service backend must use the Web platform and redeem the code as a confidential client.

If browser JavaScript redeems the code

This applies to Angular, React, Blazor WebAssembly, or other client-side applications making the token request from the browser.

1. Open Microsoft Entra admin center → Entra ID → App registrations → your application → Authentication.
2. Under Platform configurations, add Single-page application.
3. Register the exact callback URL used by the application, including scheme, host, path, port, and casing.
4. Remove that same callback URL from the Web platform if it belongs only to the SPA.
5. Use authorization code flow with PKCE:
   • The authorization request must contain code_challenge and code_challenge_method=S256.
   • The token request must contain the matching code_verifier.
6. Prefer MSAL.js rather than manually constructing these requests. Do not put a client secret in browser code.

Microsoft Entra requires PKCE for SPAs, and the spa redirect type enables the required cross-origin token redemption and CORS behavior.^1^ The portal path for assigning the redirect URI to the correct platform is documented here.^2^

A correct low-level request has this relationship:

GET /authorize?
 client_id={client-id}
 &response_type=code
 &redirect_uri={encoded-spa-callback}
 &code_challenge={challenge}
 &code_challenge_method=S256

POST /token
 grant_type=authorization_code
 &code={authorization-code}
 &redirect_uri={same-callback}
 &code_verifier={matching-verifier}

If migrating an older JavaScript application, update it to MSAL.js 2.x and move only its browser callback URIs from Web to Single-page application. The URI should then appear in the SPA platform tile.^3^

If Azure App Service redeems the code on the server

This applies when ASP.NET, Node.js, Java, Python, App Service Authentication, or another server component handles the callback and exchanges the code.

1. Open Microsoft Entra admin center → Entra ID → App registrations → your application → Authentication.
2. Add the callback under Web, not Single-page application.
3. Remove the server callback from the SPA platform if it was incorrectly registered there.
4. Under Certificates & secrets, create a client secret or configure an appropriate certificate.
5. Configure that credential only in the server-side application; never expose it to browser code.
6. Ensure the redirect_uri in both authorization and token requests exactly matches the registered Web callback.
7. Restart the App Service and initiate a completely new sign-in so that a new authorization code is issued.

Do not manually add an Origin header to a backend token request. A spa redirect URI is not supported for non-SPA flows, and Entra prevents client credentials from being used when an Origin header is present.^1^

Azure AD B2C with Microsoft Entra ID as an external identity provider

If the App Service or SPA signs in through an Azure AD B2C user flow and B2C redeems the external Entra authorization code, configure the external Entra app registration as a confidential Web application:

1. Remove its Single-page application platform.
2. Add the B2C callback under Web.
3. Create a client secret.
4. Enter that secret in the B2C OIDC identity-provider configuration.
5. Set Allow public client flows to No.

This specific configuration resolved AADSTS9002325 where B2C was redeeming the external provider’s code as a backend client.^4^

If it still fails, capture the failed /token request and compare its redirect_uri, presence or absence of Origin, and PKCE parameters with the selected platform. Preserve the request ID, correlation ID, and timestamp from the error for Entra sign-in-log investigation.

References

1. Microsoft identity platform and OAuth 2.0 authorization code flow
2. How to add a redirect URI to your application
3. Migrate a JavaScript single-page app from implicit grant to auth code flow
4. Azure AD B2C - Microsoft Q&A