Assign cryptographic key value to claim in azure ad b2c - azure-active-directory

Question

I have a technical profile to retrieve client credential flow access token from AD token end point.
I am able to assign the response access_token to claim and pass to UI through output claim (once it loaded i will hide the element and change element tpe to hidden) which will be used by JS to make certain api calls in sign up page.
Everything works fine. Here in technical profile of rest api, i used the client id and client secret values directly in default value of claim.
Is it possible to get the secret from key storage that is cryptographic keys and assign the claim?
Below is the technical profile of rest API,
<TechnicalProfile Id="TokenAPI">
<DisplayName>Rest API call</DisplayName>
<Protocol
Name="Proprietary"
Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
/>
<Metadata>
<Item Key="ServiceUrl"
>https://login.microsoftonline.com/tenant.onmicrosoft.com/oauth2/v2.0/token</Item
>
<Item Key="AuthenticationType">None</Item>
<Item Key="SendClaimsIn">Form</Item>
<Item Key="HttpBinding">POST</Item>
<Item Key="AllowInsecureAuthInProduction">true</Item>
</Metadata>
<InputClaims>
<InputClaim
ClaimTypeReferenceId="client_id"
PartnerClaimType="client_id"
DefaultValue="abd2c507-xxxx-xxxx-xxxx-xxxx"
/>
<InputClaim
ClaimTypeReferenceId="client_secret"
PartnerClaimType="client_secret"
DefaultValue="LXz2L5xxxxxxxxxxxxxxxxxxxxxxxx"
/>
<InputClaim
ClaimTypeReferenceId="grant_type"
PartnerClaimType="grant_type"
DefaultValue="client_credentials"
/>
<InputClaim
ClaimTypeReferenceId="scope"
PartnerClaimType="scope"
DefaultValue="https://TitanB2CTest.onmicrosoft.com/507-xxxx-xxxx-xxxx-xxxx/.default"
/>
</InputClaims>
<OutputClaims>
<OutputClaim
ClaimTypeReferenceId="access_token"
PartnerClaimType="access_token"
/>
</OutputClaims>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
</TechnicalProfile>

Answer 1

For the TokenAPI technical profile, you can set AuthenticationType to Basic and then add the <CryptographicKeys /> element, so that the client identifier and secret are sent in the Authorization: Basic xxx header to the token endpoint:
<TechnicalProfile Id="TokenAPI">
<DisplayName>Rest API call</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<Metadata>
<Item Key="ServiceUrl">https://login.microsoftonline.com/tenant.onmicrosoft.com/oauth2/v2.0/token</Item>
<Item Key="AuthenticationType">Basic</Item>
<Item Key="SendClaimsIn">Form</Item>
</Metadata>
<CryptographicKeys>
<Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_MyClientId" />
<Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_MyClientSecret" />
</CryptographicKeys>
...
</TechnicalProfile>