Debug your add-in from Excel or Word on the web
To debug your add-in by using Office on the web (see step 3):
8. Deploy your add-in to a server that supports SSL.
9. In your add-in manifest file, update the SourceLocation element value to include an absolute, rather than a relative, URI.
10.Upload the manifest to the Office Add-ins library in the app catalog on SharePoint.
11.Launch Excel or Word on the web from the app launcher in Office 365, and open a new document.
12.On the Insert tab, choose My Add-ins or Office Add-ins to insert your add-in and test it in the app.
13.Use your favorite browser tool debugger to debug your add-in.
Reference: https://docs.microsoft.com/en-us/office/dev/add-ins/testing/debug-add-ins-in-office-online

To use Microsoft Graph to read and write resources on behalf of a user, your app must get an access token from the Microsoft identity platform and attach the token to requests that it sends to Microsoft Graph.
One common flow used by native and mobile apps and also by some Web apps is the OAuth 2.0 authorization code grant flow.
Scenario: Email the generated invoices to customers on behalf of the current signed-in user. Any emails generated by the system will contain the invoiced.
Use Azure AD to manage identities, authentication, and authorization.

Reference:
https://techcommunity.microsoft.com/t5/microsoft-365-pnp-blog/how-to-configure-and-use-incoming-webhooks-in-microsoft-teams/ba-p/2051118