Question for OAuth setting for "Try me" function in APIM developer portal

Portal sign-in and test-console authorization are separate in APIM. The portal identity proves who can use it; an OAuth 2.0 authorization server lets the test console obtain an access token and add it to the API request. If you omit it, the console will not automatically reuse the portal-login token. A global/API validate-jwt policy will reject the request unless the caller supplies a valid Authorization bearer token another way.

You can still avoid a second credential prompt: use authorization code flow with the same B2C/Entra session, so the provider can often satisfy the token request silently, while issuing a token for the API’s audience and scopes. Register the test-console client separately, use its exact redirect URI, and validate issuer, audience, expiry, signature, and scopes or roles in the policy. Keep test-console scopes least-privileged; do not expose broadly privileged client-credential secrets in the portal. Re-publish the portal after OAuth changes.