Connecting Power Apps to Fluid using OAuth 2.0

This article explains how to connect a Microsoft Power App to the Fluid API so your app can read and write Fluid data on behalf of the signed-in user, using secure OAuth 2.0 sign-in with Microsoft Entra ID (formerly Azure AD).

The custom connector you create in this guide is shared across your Power Platform environment, so the same connection can also be used in Power Automate. If you only need Power Automate, see Setting up Power Automate to call the Fluid API using OAuth 2.0.

Fluid publishes a single, Fluid-managed "Fluid API" application in Fluid's own Microsoft Entra tenant. You do not register the Fluid API yourself, and you do not manage its Application ID URI or scopes. Instead:

1. An Entra admin grants a one-time admin consent so the Fluid API can issue tokens in your tenant.

2. You register a small connector client app of your own that signs users in and requests a token for the Fluid API (resource api://{fluid-api-client-id}).

Your Fluid Account Manager provides the Fluid API Application (client) ID you'll need.

When someone uses your Power App, Microsoft Entra ID asks them to sign in with their work account. Entra then issues a secure access token and Power Apps sends that token to Fluid with every request. Fluid checks the token and signs the user in as their matching Fluid account – no passwords or API keys are stored in your app.

For this to work, three things must be true:

1. The Fluid API is consented in your Entra tenant, and you've registered a connector client app (Part 1).

2. OAuth 2.0 is enabled on your Fluid site (a Fluid-side task).

3. Each person using the app has a Fluid account whose username matches their work email (UPN) and is active.

You will need:

These steps are performed once by a Microsoft Entra administrator in your organisation.

A Microsoft Entra administrator in your organization grants one-time consent to the Fluid API application. You generate the consent link directly from your Fluid admin console.

1. Sign in to your Fluid instance as a Fluid administrator and click on your profile picture in the top right, choose Admin Console > Authentication Provider (or navigate to /Config/AuthenticationProvider).

2. Locate the Your Entra Tenant GUID field and enter your Microsoft Entra tenant ID — a GUID in the form xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. You can find this in the Azure Portal under Microsoft Entra ID > Overview.

3. Once you have entered your tenant ID, the Fluid API Consent Url field automatically builds the correct admin-consent link for your tenant.

4. Click the copy icon next to the Fluid API Consent Url field to copy the link to your clipboard. It will look similar to:

   https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/adminconsent?client_id=69c9b574-a5bf-46ca-bb04-ed5793d298e4&redirect_uri=https://www.fluid.work

5. Send the copied link to a Microsoft Entra administrator in your organization (or open it yourself if you hold that role). The administrator opens the link, signs in, and accepts the permissions prompt. This provisions the Fluid API in your tenant so it appears under APIs my organization uses in Step 3.

This is a consent step, not an app registration. You are approving Fluid's published application — you don't create or own it. Without this consent, sign-in may fail with AADSTS650057 or "Need admin approval".

This is a small app of your own that the connector signs in with (it is not the Fluid API).

1. Sign in to the Microsoft Entra admin center as an administrator.

2. Go to Identity > Applications > App registrations > + New registration.

3. Fill in the registration form:

   • Name: Fluid Connector

   • Supported account types: Accounts in this organizational directory only

   • Leave Redirect URI blank

4. Select Register.

5. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

In the Fluid Connector app, select API permissions and add two delegated permissions:

a) Fluid API – access_as_user:

1. Select + Add a permission > APIs my organization uses.

2. Search for the Fluid API (by name or by the Fluid API client ID) and select it.

3. Choose Delegated permissions, tick access_as_user, then select Add permissions.

b) Microsoft Graph – User.Read (Power Apps connectors require this; without it sign-in fails with AADSTS90008):

1. Select + Add a permission > Microsoft Graph > Delegated permissions.

2. Search for User.Read (Sign in and read user profile), tick it, then select Add permissions.

Finally, select Grant admin consent for [Your Organisation] and confirm — both permissions should show a green tick.

The Fluid API only appears under APIs my organization uses after Step 1 (admin consent) has provisioned it in your tenant. Fluid itself does not receive or use any Microsoft Graph data — User.Read is used by Power Apps to complete the sign-in flow.

The Power Apps custom connector signs in using a client secret (think of it as the connector app's password).

1. In the Fluid Connector app, select Certificates & secrets > Client secrets > + New client secret.

2. Enter a description (for example, Power Platform connector) and choose an expiry that matches your organisation's policy.

3. Select Add.

4. Immediately copy the secret Value (not the Secret ID). You won't be able to see it again after you leave the page.

Treat the client secret like a password. Store it securely and set a reminder to renew it before it expires — the connection stops working when the secret expires.

Give the Power Apps maker the following details before moving to Part 2:

Open Notepad and paste these values in as you collect them — you'll copy them straight into Power Apps in Part 2.

These steps are performed by the Power Apps maker who will build the app.

A custom connector is the bridge between Power Apps and the Fluid API.

1. Go to make.powerapps.com and confirm (top-right) that you're in the correct environment.

2. In the left menu select More > Discover all, then under Data open Custom connectors.

3. Select + New custom connector. If a dropdown appears, choose Create from blank; in newer environments this opens the blank connector editor directly. (Avoid the Import options — those expect an OpenAPI or Postman file.)

4. Give it a name, for example Fluid, and select Continue.

On the General page:

• Host: your Fluid web address without https:// — for example yourcompany.fluid.work

• Base URL: /

Select Security to continue.

On the Security page, fill in the following fields:

• Authentication type: OAuth 2.0

• Identity Provider: Azure Active Directory

• Client id: the connector app's Application (client) ID (from Step 2)

• Client secret: the client secret value from Step 4

• Login URL: leave the default (typically https://login.windows.net)

• Tenant ID: the Directory (tenant) ID

• Resource URL: api://{fluid-api-client-id} — for example api://00001111-aaaa-2222-bbbb-3333cccc4444

• Scope: api://{fluid-api-client-id}/access_as_user (if left blank, Power Apps requests a default scope, which also works once the connector is authorised)

• Leave Enable on-behalf-of login set to off

Select Create connector (top right) to save.

Because the connector's Client ID (your connector app) and the Resource (the Fluid API) are different app registrations, use the full api://… Resource URL. The earlier AADSTS90009 "requesting a token for itself" problem does not occur in this model.

After the connector is saved, Power Apps generates a Redirect URL shown at the bottom of the Security page, usually:

https://global.consent.azure-apim.net/redirect

Register it on your connector client app:

1. Copy the Redirect URL from the connector's Security page.

2. In the Entra admin center, open your Fluid Connector app > Authentication.

3. Select + Add a platform > Web, paste the Redirect URL, and select Configure. (If a Web platform already exists, add the URL to the existing Redirect URIs list.)

4. Select Save.

If sign-in later fails with a message about a reply URL or redirect URI mismatch, this is almost always the step that was missed or mistyped.

The connector needs at least one operation defined before the Test tab will let you run a call.

1. In the connector editor, open the Definition tab.

2. Select + New action.

3. Give the action a Summary (e.g. Get projects) and an Operation ID (e.g. GetProjects).

4. Under Request, select + Import from sample:

   • Verb: GET

   • URL: a Fluid API endpoint, for example https://yourcompany.fluid.work/api/data/v1/projects

   • Select Import

5. Select Update connector (top right) to save.

For a full list of Fluid API endpoints, see the Fluid API documentation or ask your Fluid account manager. For a quick sign-in test, any valid GET endpoint that returns 200 confirms OAuth is set up correctly.

1. Back in the custom connector, open the Test tab.

2. Under Connections, select + New connection.

3. Sign in with your work account and accept the permission prompt.

4. Once connected, select an operation and choose Test operation to confirm Fluid responds (HTTP 200).

1. Open or create a Canvas app in the app editor.

2. In the Data pane select + Add data; search for your Fluid connector and add it.

3. Use the connector's actions in your app — for example, bind a gallery to a Fluid list, or call an action from a button's OnSelect.

Each person who uses the published app signs in with their own work account, so they only see and change the Fluid data their own Fluid permissions allow.

• For the Fluid side (enabling OAuth 2.0, the Fluid API client ID, user accounts and permissions), contact your Fluid System Administrator or your Fluid Account Manager.

• For the Microsoft Entra side (admin consent, the connector app, secrets), contact your Microsoft 365 / Azure administrator.

• Excel and Power BI using OAuth 2.0

• Scheduling automatic Power BI refresh from Fluid OAuth 2.0

• Programmatic access to the Fluid API using OAuth 2.0

• Setting up Power Automate to call the Fluid API using OAuth 2.0