We are looking to integrate oneDrive in our webapp. What this means is that user will

1. authenticate himeself.
2. pass auth token to the backend
3. backend fetches the access token and refresh token
4. Now if a user is looking to access the one drive then it request for the access token from backend
5. using this access token, the front end opens the one drive picker

The api calls are as follows
for point 1,

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
client_id=<myclientid>
&response_type=code
&redirect_uri=<my_redirect_url>
&response_mode=query
&scope=https://graph.microsoft.com/offline_access&openid email&AllSites.Read&MyFiles.Read
&state=12345

for point 2, access token is received using the following curl request

curl --location 'https://login.microsoftonline.com/common/oauth2/v2.0/token' 
--header 'Content-Type: application/x-www-form-urlencoded' 
--header 'Cookie: buid=0.AVIAmD-ag0Mg-E2a_LvJQo6Z0sjx6FbMkqNPv3qUaSY08ly6AAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMYulFO_B9eoSd7SaOMo2wYarBsQfk113IeYqHwDe7VQ9IOiRHw3OHAwBC0ScQiDKVUE8bi_BfFCA_baSrLSIvNF9Fp5qCmrW0vXsFXy8gRZ78gAA; esctx=PAQABBwEAAAApTwJmzXqdR4BN2miheQMYsyKGsQ2FnoCI0RFkCmeLTvxdrU2MRy8Z9nTU2JgrI_WB-ntq9BqLSKF2sBCMsvN1fHgQaSN551uIKz4xJannZA00WpyQVdD_gH7Kp4dvM9EADTKx0Lh7qDj5L32NC5TDTSMtrU6gDIncwmlIsCsE4jOcUVMgKCzYKNEWGQXoB_MgAA; esctx-huObqjU8a4=AQABCQEAAAApTwJmzXqdR4BN2miheQMYfXR-8ncTc3MuXdM6OuWjcCEufkeO4NcHxndWObzyc54dCThlVy1SY5ILOuUJcggyoD7ISVnLr82theA68ynKp22B_-gI-I8q6ogp7Ts8os6D7Rzknsk8E7UnNs0SCaoIcyOQKcKegYoQiKeo3qemNyAA; fpc=AtGUmlW3DENLlzL5xQ279-ti373FAQAAAJk-NN4OAAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd' 
--data-urlencode 'grant_type=authorization_code' 
--data-urlencode 'client_id=my_client_id' 
--data-urlencode 'client_secret=**my_client_secret**' 
--data-urlencode 'code=**code_as_received_in_step_1**' 
--data-urlencode 'redirect_uri=<my_redirect_url>' 
--data-urlencode 'scope=offline_access openid email AllSites.Read MyFiles.Read'

3. Using the access token in step 2 we now supply the same to the front end and it uses it to open the one drive picker

account used for microsoft onedrive using email <my_onmicrosoft_account>

params for url generation
const params = {
        client_id: "my_client_id",
        redirect_uri: "my_redirect_url",
        response_type: "code",
        scope: ".default",
        prompt: "consent",
        state: encodeURIComponent("one_drive")
    };

    const url = new URL("https://login.microsoftonline.com/common/oauth2/authorize");
    const baseUrl = `${new URL("https://proshortinc-my.sharepoint.com").origin}/
_layouts/15/FilePicker.aspx`;

Once we click button to open filepicker, we get an error in concole of the browser

Error in file picker
plt.listviewdataprefetch.js:50
POST https://proshortinc-my.sharepoint.com/_api/SP.Directory.DirectorySession/me?$select=mySite,displayName 500 (Internal Server Error)

I also get this error 4183: The Security Token failed Audience restriction validation

I tried all sort of help on internet and contacting MSFT. but no help is coming