Microsoft Bot - Authenticate exposed API endpoint (IDX10205: Issuer validation failed)

Trying to add authentication/authorization to an exposed endpoint by a Microsoft Teams Bot.
The bot is deployed on Azure; bot-things working fine so far.

It's exposing 2 endpoints:

• /api/messages: this is used as BOT URL.
• /api/notify: this is the endpoint I want to add authentication & authorization.

Context: the Bot is exposing /api/notify so an external service will call here making the bot to send activities to public channels.

Azure Configuration overall

The Bot Channel Registration is linked to a registered app on the Active Directory. This registered app has a will-never-expire secret. The src code itself uses this applicationId and secretId.

What I've tried

• App service > Authentication: App Service Authentication ON/Login with Azure Active Directory
  • ClientId: the applicationId
  • Issuer URL: https://login.microsoftonline.com/{tenantId}
• Authentication tab: I've added a Web platform:
  • https://{my-service}.azurewebsites.net/.auth/login/aad/callback
• Supported account types: Accounts in any organizational directory (Any Azure AD directory - Multitenant)

• Enable Implicit Grant flow > Open ID tokens

• not sure if I need to "Expose an API" and set as Application URI the base URL of the bot service (https://{my-service}.azurewebsites.net);

• not sure if I need to register a second app in the Active Directory and have a tuple: "bot app"/"authentication provider" and re-think the whole thing

In the end, I want the external service to authenticate using a pair "clientId/clientSecret" and making HTTP requests to {my-service}.azurewebsites.net/api/notify;

• no token -> 401
• valid token -> ok

The problem

With this configuration the bot stops authenticating itself, if I - for instance - open the emulator and use the original applicationId + secret credentials, the initial POST to /api/messages receives:

{
  "value": {
    "code": 401,
    "message": "IDX10205: Issuer validation failed. Issuer: '[PII is hidden]'. Did not match: validationParameters.ValidIssuer: ..."
  }
}