Using an access token for the Azure Devops rest API

I'm trying to use the devops Rest API to work with pipelines.

I'm requesting an access token, then using it to make the devops post request.

        string orgName = "MyOrg";
        string project = "MyProject";
        string tenantId = "0eb...";
        string authority = $"https://login.microsoftonline.com/{tenantId}";
        string clientId = "656...";
        string clientSecret = "n.C...";
        string scope = "499b84ac-1321-427f-aa17-267ca6975798/.default"; // Azure DevOps access scope

        var app = ConfidentialClientApplicationBuilder
            .Create(clientId)
            .WithClientSecret(clientSecret)
            .WithAuthority(new Uri(authority))
            .Build();

        var result = await app.AcquireTokenForClient(new[] { scope }).ExecuteAsync();
        string accessToken = result.AccessToken;

        using var client = new HttpClient();
        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

        HttpResponseMessage response2 = await client.GetAsync($"https://dev.azure.com/{orgName}/{project}/_apis/pipelines?api-version=7.0");
        string responseBody = await response2.Content.ReadAsStringAsync();

In the Azure portal Active Directory blade, I have registered an app, and am using the Directory (tenant) ID listed in the overview page as the tenantId. In the Certificates & secrets submenu, I have created a client secret, and am using the Value as the clientId and the Secret ID as the clientSecret. My understanding is that the scope 499b84ac-1321-427f-aa17-267ca6975798/.default is a hardcoded guid that resolves to all devops permissions.

I am getting this for a response:

TF401444: Please sign-in at least once as {tenantId}\\\\{tenantId}\\\\{guid I dont recognize} in a web browser to enable access to the service.\",\"typeName\":\"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server\",\"typeKey\":\"UnauthorizedRequestException\",\"errorCode\":0,\"eventId\":3000}"

I don't understand what I am missing here. Why am I being asked to login? Shouldn't the token be enough to authorize my api request? My goal here is for an API service to be able to work with pipelines. Any help would be much appreciated.

Your app registration needs to have permission to access the Devops REST API. This is configured in the API Permissions section of the App Registration. It also looks like you're trying to use a Client Credential Flow (client ID and Secret).

Looking at the portal, it doesn't appear that Application permissions - which you need with Client Credential flow - is available for Azure Devops, so this approach is not going to work.

You have two options:

1. In a web app, use delegated permissions and the logged in user's security context

2. Use a PAT (personal access token) and a Basic Auth header in your REST call.