I have successfully implemented Oauth2.0 authorization into a .Net8 service and was able to consumed it through both Postman and Swagger(using pkce).

However when it came time to consume it through another .Net service I encountered issues.
I have been able to obtain the token but I still get a 403 when attempting to consume the service endpoint.

This is my Authorize() method:

var authority = $"https://login.microsoftonline.com/{_config.TennantId}/oauth2/v2.0/token";

var app = ConfidentialClientApplicationBuilder
.Create(_config.ClientId)
.WithClientSecret(_config.ClientSecret)
.WithAuthority(authority)
.Build();

var result = await app.AcquireTokenForClient(new string[] { $"{_config.Scopes}" })
    .ExecuteAsync();

return new AuthenticationHeaderValue("Bearer", result.AccessToken);

This is the authorization configuration on the target app:

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration);

This is the controller of the target app:

[Authorize]
[RequiredScope("WriteOperations", ".default")]
[ApiController]
public class CustomersController : ControllerBase

I also added the .default specifically because I read that the client credentials flow and on behalf flows can only work with .default.

I know that for Postman and swagger one needs to provide a redirect Url. But the documentation I found for backend to backend flows, doesn’t include any mention of one.

What am I doing wrong and how can I fix this.