Connecting to secured APIs
Consuming APIs secured with Entra ID within an SPFx web part or extension is a fairly common business scenario. This is, for example, the case whenever your solution needs to access data using the Microsoft Graph API, or any API secured with an Entra ID application, such as a custom enterprise application or web service.
Because this type of application relies on the Open Authorization (OAuth 2.0) standard to authenticate the client and access underlying resources (i.e., APIs such as https://graph.microsoft.com/ or https://your_api/), the client needs to first obtain a valid access token to access them (also referred as a bearer token).
This token is obtained as part of the OAuth 2.0 authorization flow that the client solution needs to implement, in this case, your SPFx component. This token must also provide the correct API permission scopes according to the requested operation (for instance, the Files.Read.All scope to be able to read files from a...
