Hi @Anonymous
I believe <portal_url>/_services/auth/token only support post now and the browser uses get. You will need to go into the console on the browser and call the post action from there.
When it comes to authentication, using APIM to call your custom API, will allow you validate the power pages token in APIM using JWT validate in the inbound policies. Better to extract the username from the token with in the policy and pass it to your custom API for any authorizations you may need in the custom API.
A question that's probably worth asking though, is it really necessary to use a custom api? You will need to use client side javascript to do so and this carries it's own concerns of where users can manipulate it at the browser. Power pages works best with the data is on dataverse, is it a possibility to copy the required data to there?
Or wait for the new feature due for release to preview shortly where one can call a Power Automate flow that can then call your custom API from power pages. Not sure what the lag will be like on this but if it's fast, it will be very promising for simplifying the whole area. Use cloud flows with Power Pages sites
Regards
