Objective: To use an Excel add-in, written using Blazor, to access any downstream or third-party API.
The particular API in mind is that of MS Business Central (BC).

Using this example: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-single-page-app-blazor-wasm-sign-in and this guide: /a/65574222 I have a normal Blazor wasm project that works. This is quite elegant and contains no IDs other than the Azure App Client ID and suitable URLs and scopes. I am also satisfied that the various permissions etc. are set correctly in the Azure app, since I can access Graph and Business Central with no issues. The project is in .NET 8.0.

// program.cs    
using Microsoft.AspNetCore.Components.Web;
using Microsoft.AspNetCore.Components.WebAssembly.Authentication;
using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
using Microsoft.AspNetCore.Components;
using static System.Net.WebRequestMethods;
using System.Text.Json;

var builder = WebAssemblyHostBuilder.CreateDefault(args);
builder.RootComponents.Add<App>("#app");
builder.RootComponents.Add<HeadOutlet>("head::after");

builder.Services.AddMsalAuthentication(options =>
{
  builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
  options.ProviderOptions.DefaultAccessTokenScopes.Add("https://graph.microsoft.com/User.Read");
  options.ProviderOptions.AdditionalScopesToConsent.Add("https://api.businesscentral.dynamics.com/.default");
});

builder.Services.AddScoped(sp =>
{
  var authorizationMessageHandler = sp.GetRequiredService<AuthorizationMessageHandler>();
  authorizationMessageHandler.InnerHandler = new HttpClientHandler();
  authorizationMessageHandler.ConfigureHandler(
      authorizedUrls: new[] { "https://graph.microsoft.com/v1.0" },
      scopes: new[] { "User.Read" });
  return new HttpClient(authorizationMessageHandler);
});

builder.Services.AddScoped<CustomAuthorizationMessageHandler>();
builder.Services.AddHttpClient("MyAPI", client => client.BaseAddress = new Uri("https://api.businesscentral.dynamics.com/v2.0/"))
                .AddHttpMessageHandler<CustomAuthorizationMessageHandler>();

await builder.Build().RunAsync();

// Custom AuthorizationMessageHandler
public class CustomAuthorizationMessageHandler : AuthorizationMessageHandler
{
  public CustomAuthorizationMessageHandler(IAccessTokenProvider provider,
      NavigationManager navigationManager)
      : base(provider, navigationManager)
  {
    ConfigureHandler(
        authorizedUrls: new[] { "https://api.businesscentral.dynamics.com/v2.0" },
        scopes: new[] { "https://api.businesscentral.dynamics.com/.default" });
  }
}

public class CustomAuthorizationMessageHandler : AuthorizationMessageHandler
{
  public CustomAuthorizationMessageHandler(IAccessTokenProvider provider,
      NavigationManager navigationManager)
      : base(provider, navigationManager)
  {
    ConfigureHandler(
        authorizedUrls: new[] { "https://api.businesscentral.dynamics.com/v2.0" },
        scopes: new[] { "https://api.businesscentral.dynamics.com/.default" });
  }
}

// appsettings.json
{
  "AzureAd": {
    "Authority": "https://login.microsoftonline.com/91321380-fake-fake-fake-d2hello3cc8c",
         "ClientId": "e2xx415f-fake-fake-fake-37afaketoocb43f331b",
         "ValidateAuthority": true
         }
}

// Usage
@using Microsoft.AspNetCore.Components.Authorization
@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
@using System.Text.Json

@inject HttpClient Http
@inject IHttpClientFactory clientFactory

private JsonDocument? graphApiResponse = null;
private JsonDocument? jsonDocument = null;

using var response = await Http.GetAsync("https://graph.microsoft.com/v1.0/me");
response.EnsureSuccessStatusCode();
graphApiResponse = await response.Content.ReadFromJsonAsync<JsonDocument>().ConfigureAwait(false);

// Get data from BC
var apiClient = clientFactory.CreateClient("MyAPI");
string s = await apiClient.GetStringAsync("https://api.businesscentral.dynamics.com/v2.0/sbdream/api/v2.0/companies");
jsonDocument = JsonDocument.Parse(s); // for binding to view
Console.WriteLine("myAPI:" + s);

I thought I could use this knowledge when creating the Blazor Excel add-in. But how? A big problem seems to be that the log-in to Excel/Office gets a token, using JavaScript, with Office.auth.getAccessToken. I realise that I can not use this token directly with even the Graph API and not with the BC API – instead, a new token has to be obtained as per the on-behalf-of (OBO) flow. But I am also aware that I can not (should not) use a client secret string in browser code.

So, just how can I do this – authenticate with Office, then call Graph or Business Central (or any other) APIs? Is this even achievable? Or, should stop trying to do all this in the WASM project and instead create an additional project (“middleman”) which is an API that will run on Azure, to provide the required access? Doing it that way seems to require almost replicating the same API calls in the middleman project that are in Graph and BC – which doesn’t sound right or efficient.

With the myriad examples in this whole area, none of which seem to do exactly what I want, I am struggling to see the wood for the trees. Any guidance would be hugely appreciated.