Authenticating against Microsoft Graph API

[var-log-skynet]

I struggled with this and got some bits of information from here and there, so I share my working config for anyone wanting avoid using graph explorer:

At the entra portal I enabled the Mobile and desktop applications platform, but I did not set any URI-s. Also I have access and id token types checked in. https://www.thunderclient.com/oauth/callback added to SPA redirect uris. The auth config is as follows. Mind the origin header!