Microsoft Bot - Authenticate exposed API endpoint (IDX10205: Issuer validation failed) - azure

Question

Trying to add authentication/authorization to an exposed endpoint by a Microsoft Teams Bot.
The bot is deployed on Azure; bot-things working fine so far.
It's exposing 2 endpoints:
/api/messages: this is used as BOT URL.
/api/notify: this is the endpoint I want to add authentication & authorization.
Context: the Bot is exposing /api/notify so an external service will call here making the bot to send activities to public channels.
Azure Configuration overall
The Bot Channel Registration is linked to a registered app on the Active Directory. This registered app has a will-never-expire secret. The src code itself uses this applicationId and secretId.
What I've tried
App service > Authentication: App Service Authentication ON/Login with Azure Active Directory
ClientId: the applicationId
Issuer URL: https://login.microsoftonline.com/{tenantId}
Authentication tab: I've added a Web platform:
https://{my-service}.azurewebsites.net/.auth/login/aad/callback
Supported account types: Accounts in any organizational directory (Any Azure AD directory - Multitenant)
Enable Implicit Grant flow > Open ID tokens
not sure if I need to "Expose an API" and set as Application URI the base URL of the bot service (https://{my-service}.azurewebsites.net);
not sure if I need to register a second app in the Active Directory and have a tuple: "bot app"/"authentication provider" and re-think the whole thing
In the end, I want the external service to authenticate using a pair "clientId/clientSecret" and making HTTP requests to {my-service}.azurewebsites.net/api/notify;
no token -> 401
valid token -> ok
The problem
With this configuration the bot stops authenticating itself, if I - for instance - open the emulator and use the original applicationId + secret credentials, the initial POST to /api/messages receives:
{
"value": {
"code": 401,
"message": "IDX10205: Issuer validation failed. Issuer: '[PII is hidden]'. Did not match: validationParameters.ValidIssuer: ..."
}
}