AI was used to create this answer
Your code contains a few issues that need to be resolved for it to properly fetch the token from Azure AD.
1. mode: 'no-cors' Issue
The no-cors mode prevents JavaScript from seeing the response content due to browser security policies. When using no-cors, the browser restricts the request to only a limited set of safe headers, methods, and body types, which breaks your API call. Since you're working with an authentication endpoint, no-cors mode is not appropriate.
Solution:
Remove mode: 'no-cors' entirely from the requestOptions. The default mode (cors) will work for this scenario if the endpoint allows cross-origin requests.
2. Incorrect Content-Type for the Request Body
The Content-Type header specifies the format of the data in the request body. Since you’re sending URLSearchParams as the body, the correct Content-Type is application/x-www-form-urlencoded, which you’ve already set correctly. However, ensure that URLSearchParams is properly serialized.
3. Ensure Proper URL and Parameters
Make sure you are replacing placeholders like "tenantid", "my client id", and "my client secret" with actual values.
https://login.microsoftonline.com/tenantid/oauth2/v2.0/token → Replace tenantid with your Azure Active Directory (AAD) tenant ID.- Verify your
client_id and client_secret match the app registration in Azure AD.
4. Handling the Response Properly
The response from Azure AD is JSON, not plain text, so you need to parse it as JSON using .json() instead of .text().
5. Debugging CORS and Cross-Origin Issues
The browser might block the request due to CORS policy if the endpoint doesn't allow requests from your domain. To test this without being blocked:
- Use Postman or a similar tool to confirm that the request works outside the browser.
- If CORS issues persist, you may need to set up a server-side proxy or handle authentication on a backend to avoid browser limitations.
Fixed Code
Here’s your corrected JavaScript code:
Additional Notes:
-
Test in a Local Development Environment
- If you’re running this code in a browser and facing CORS issues, consider testing it first in Node.js (outside the browser) or using Postman. This can help confirm whether the issue is with the request setup or browser limitations.
-
Environment Variables for Secrets
- Avoid hardcoding
client_id and client_secret directly in the code. Use environment variables or a secure way to store them to prevent accidental exposure.
-
Error Handling
- The error handling logic (
if (!response.ok)) ensures that you catch HTTP errors and don't blindly try to parse the response if it’s invalid.
-
Token Expiration
- The token you retrieve will expire after a certain period (usually 1 hour). Make sure to implement token caching or re-fetch the token when necessary.
Common Debugging Steps
-
Verify that the AAD App Registration (Azure Portal) has the necessary API permissions for Business Central.
- API Permission:
Delegated or Application access to Dynamics 365 Business Central.
- Grant admin consent after setting the permissions.
-
Double-check the tenant_id, client_id, and client_secret are correct and correspond to the app registration.
-
Ensure the app registration allows client_credentials flow in its Authentication settings.
