decomplexity

Apart from the "user= auth=bearer" prefix and having a verifiable signature, the token looks corrupt: for example the '.' (full-stop) dividers that should separate the header, payload and signature are...

Sorry, but don't fully understand your reply. Your 'me + AI + firebase' token is a valid token but won't authenticate because apart from _sub_, _name_ and _iat_ it has...

The POP support is an obsolete method of sender authentication: roughly, if the sender can authenticate to receive POP mail, then they are authenticated to use SMTP sending also. POP...

Worth checking that the userid you are using at login is the same user principal name you used when registering the app (and hence the user name associated with the...

It might be worth establishing whether $user['givenName'], say, is really not set or is empty, since ?? will be true in either case; if false $user_first_name will evaluate as empty...

What please is the value of AUD in the token claims?

Ah. I assumed that your "I've checked the token and it is the value created" meant that you had decoded the access token. You can easily check the client id....

Since the error message is saying that either or both of the client ID (which you input) and AUD (which you didn't) are bad, could you please reply with the...

I cannot tell what the garbage is, but if you are using Graph as the resource provider, the AUD should be https://graph.microsoft.com. If instead you are using a non-Microsoft package...

React with @azure/msal-browser (i.e. V2) will force a PKCE code challenge with a (default) code challenge method of S256 for an SPA with authorization_code flow. From memory, I don’t believe...