Web API cannot have any user interaction, and therefore when a web API (named "Web API #1") needs to call another Web API (named "Web API #2") in the name of a user, it needs to use the On Behalf Of OAuth 2.0 flow.

This flow is a confidential client flow, and therefore the first web API provides client credentials (client secret or certificate), as well as an UserAssertion. The first web API will receive a bearer token and send it to Azure AD by embedding it into a UserAssertion to request another token to the downstream second Web API.

 ConfidentialClientApplication cca = ConfidentialClientApplication.builder(clientId, ClientCredentialFactory.create(CLIENT_SECRET)). authority(AUTHORITY). build(); // Create an UserAssertion with the access token received from the client application UserAssertion userAssertion = new UserAssertion(accessToken); AuthenticationResult result = cca.acquireToken( OnBehalfOfParameters.builder( Scope, userAssertion). build()). get();