I have successfully registered an app and can generate a JWT to get a token for my app to upload files directly into a Sharepoint site.

I’m now trying to read this list of files back but the same token keeps saying Unauthorized.

The only useful headers appear to be

'x-forms_based_auth_required' => 'X-Forms_Based_Auth_Required',
'x-forms_based_auth_return_url' => 'X-Forms_Based_Auth_Return_Url'

This to me suggests I need to login as a form (i.e. a user) as opposed to using an app/daemon?

 
$url = 'https://login.microsoftonline.com/<<tenant ID>>/oauth2/v2.0/token';
        $token = json_decode($guzzle->post($url, [
            'form_params' => [
                'client_id' => '<<client ID>>',
                'client_secret' => '<<client secret>>',
                'scope' => "https://<<site>>.sharepoint.com/.default",
                'grant_type' => 'authorization_code',
            ],
        ])->getBody()->getContents());
        $accessToken = $token->access_token;

Running my access token through JWT I get what I think I’d expect, and the appropriate permissions

I have tried with both access tokens generated from a certificate (which works for uploading files) and a user/secret.

I’m using this URL to GET —

 $response = $http->get($siteURL. "/_api/web/lists/getbytitle('Documents')/items", [
            'headers' => [
                'Accept' => 'application/json;odata=verbose',
                'Authorization' => 'Bearer ' . $accessToken,
            ]
        ]);

any ideas what I’m missing?