Regardless of the framework, you’ll need the access token and not the ID token to call your API. What type of errors are you receiving? Anything helpful? If I had to guess it would be due to a mismatch in audience value - The audience (API identifier) you call /authorize with needs to match the audience configured at your API.