How to setup customer to obtain AADB2C token for an API exposed through APIM

You need machine-to-machine tokens for external customers in addition to APIM subscription keys. Client credentials is appropriate only for confidential applications acting as themselves; it does not represent an interactive user. In the Azure AD B2C tenant, register the protected API and expose application permissions, register one confidential client per customer, grant the required permission, and have an administrator consent. The customer requests a token from the B2C policy token endpoint using client_credentials and the API’s .default scope. In APIM, keep the subscription-key check and add an inbound validate-jwt policy using the B2C OpenID configuration, expected audience, issuer, and required application claim or role. Store identifiers as named values and test invalid audience, expired token, missing role, and revoked secret. Client credentials in Azure AD B2C is documented as preview, and B2C is unavailable to new customers. For a new design, evaluate Microsoft Entra External ID before committing to B2C.