SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following code in my SharePoint add-in (SharePoint Online). Simple code just to load the list items, the code works fine

        url: appweburl + "/_api/web/lists/getbytitle('MyList')/items",
        type: "GET",
        headers: { "Accept": "application/json;odata=verbose" },
        cache: false,
        success: function (data) {
            alert('Successfully obtained data.');
        error: function (data) {

My confusion is, I am not passing any access token and from what I know the access token is required to let the add-in access data. So how is this working?

share|improve this question

The browser passes over the FedAuth cookie with the XHR request, and that authenticates you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.