Team SSO - How to call my API

[gauravsarwal]

I am new to Team app development and thinking of developing an app with tab, bot and messaging extension. The authentication part is but confusing and I need some guidence.

Team SSO requires registering an application in entra with scope access_as_user so that we can get their tenantid, userid etc, Team client side SDK method microsoftTeams.authentication.getAuthToken(), provide this token. Now if I need to call my API which I can protect with Entra schema too too along with others , I am not sure what is best way to call my API, I think of these options:

1.Do I need to use on behalf of (OBO) flow like we need to do for downstream API like teams for my web services to exchange the Team entra app token to get access token for my API. For this I need to add my API permssion to Team Entra app like we have for graph.
2. Directly use the token issues by microsoftTeams.authentication.getAuthToken() to call my API, So my API will trust Team entra app and validate the issuer, audience etc.
3. My back end take token from team app and extract teantid, clientid, userid etc and call my API using client credential flow.

I am not sure what is primary purpose of token issued by microsoftTeams.authentication.getAuthToken(), can it be used to call API directly or I need to do OBO flow always. Any help or suggestion will be appreciated.