SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following code in my SharePoint add-in (SharePoint Online). Simple code just to load the list items, the code works fine

        url: appweburl + "/_api/web/lists/getbytitle('MyList')/items",
        type: "GET",
        headers: { "Accept": "application/json;odata=verbose" },
        cache: false,
        success: function (data) {
            alert('Successfully obtained data.');
        error: function (data) {

My confusion is, I am not passing any access token and from what I know the access token is required to let the add-in access data. So how is this working?

share|improve this question

The browser passes over the FedAuth cookie with the XHR request, and that authenticates you.

share|improve this answer
But FedAuth only appears in some condition (FBA, ADFS etc), In my configuration there's no FedAuth, do you know how the rest API is authenticated in SharePoint in that case (windows claims + NTLM)?, see my post… – Wint Jun 27 at 9:23
If you're using NTLM it'll be using the Bearer HTTP Header. – James Love Jun 27 at 13:00
In my environment the SharePoint pages are authenticated in standard NTLM procedure (server respond with WWWAuthenticate: NTLM and so on), however, after authenticated, I cannot find any token like things in subsequent successful api call. (I have manually cleared cookie WSS_KeepSessionAuthenticated), I wonder how SharePoint authenticate/associate these api call with current user. I can post a new question if my description is not clear here and invite you, Thanks a lot! – Wint Jun 27 at 15:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.