从Postman调用SharePoint API时遇Token type is not allowed错误

已成功获取access token，但调用SharePoint REST API获取文件和文件夹时返回错误：

{"error":"invalid_request","error_description":"Token type is not allowed."}

获取access token的请求详情 #

EndPoint:https://accounts.accesscontrol.windows.net/<Tenant Id>/tokens/OAuth/2/

POST /<Tenant Id>/tokens/OAuth/2/ HTTP/1.1
Host: accounts.accesscontrol.windows.net
Cookie: esctx=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrQ2zm7id5dHijP-KNh0_nsy_HRv7Zbu-6H7sTe7hlArzkhSFqbVHuenAG9ExQIsQYbtrHIjBNNgV2JRx70Ls01rJRmxIaUzGMS-qWOYOvT4w_lm0bGcmVmUT7CWvkGUlPIAA; fpc=AlP6y8D8GRBCoEgfeLYN1RQMaUJ-AQAAAKoBt9sOAAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd
Content-Length: 641
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="grant_type"

client_credentials
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="client_id"

<Client ID>@<Tenant ID>
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="client_secret"

<Client Secret>
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="resource"

00000003-0000-0ff1-ce00-000000000000/<Domain>.sharepoint.com@<Tenant ID>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

调用SharePoint REST API的请求详情 #

EndPoint:https://<Domain>.sharepoint.com/sites/WinFileMgmSite/_api/web/getfolderbyserverrelativeurl('Shared Documents/Salesforce')?$expand=Folders/ListItemAllFields/FieldValuesAsText,Files/ListItemAllFields/FieldValuesAsText

GET /sites/WinFileMgmSite/_api/web/getfolderbyserverrelativeurl('Shared Documents/Salesforce')?$expand=Folders/ListItemAllFields/FieldValuesAsText,Files/ListItemAllFields/FieldValuesAsText HTTP/1.1
Host: <Domain>.sharepoint.com
Accept: application/json;odata=verbose
Authorization: Bearer <Access Token>

已完成的排查步骤 #

• 确认应用权限配置正确，Permission Request XML如下：

  <AppPermissionRequests AllowAppOnlyPolicy="true">
  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
  </AppPermissionRequests>
  

• 验证请求的URL和HTTP方法无误
• 确认access token有效且未过期

错误原因及解决方案 #

错误原因 #

当前使用的是旧版ACS（Access Control Service）端点获取的token，而现代SharePoint Online已不再支持ACS颁发的token调用REST API，必须使用Azure AD v2.0端点颁发的token。

解决方案 #

1. 切换到Azure AD v2.0端点获取token

   • 请求端点：https://login.microsoftonline.com/<Tenant Id>/oauth2/v2.0/token
   • 请求需使用application/x-www-form-urlencoded格式，参数如下：

     grant_type=client_credentials
     client_id=<你的Client ID>
     client_secret=<你的Client Secret>
     scope=https://<Domain>.sharepoint.com/.default
     

   • 前置操作：在Azure AD应用注册中添加SharePoint Online的应用权限（如Sites.FullControl.All），并完成管理员同意。

2. 验证API调用
   获取到Azure AD颁发的token后，保持原SharePoint REST API的调用方式不变，仅替换Authorization头中的token即可。

3. 推荐方案：使用Microsoft Graph API
   若业务场景允许，优先使用Microsoft Graph API操作SharePoint文件，示例端点：

   GET https://graph.microsoft.com/v1.0/sites/<Domain>.sharepoint.com:/sites/WinFileMgmSite:/drive/root:/Shared Documents/Salesforce:/children
   

   此方式同样使用Azure AD v2.0端点的token，需配置对应权限（如Files.ReadWrite.All）。

内容的提问来源于stack exchange，提问作者JEGAN J