I am making a Provider-Hosted Sharepoint 2013 app in PHP. I have successfully authenticated with OAuth and can make requests on behalf of a user but I am struggling to figure out how to make requests using the App-Only policy so I can execute requests with elevated permissions.

From my understanding I need to make requests with a App only token, but I do know how to retrieve this. The only examples I can find seem to use a the TokenHelper C# library which does not reveal any implementation details of the underlying requests that need to happen.

Any help would be much appreciated.


Edit: I have <AppPermissionRequests AllowAppOnlyPolicy="true"> set in my App's manifest

  • Running into the same problem. The REST API documentation generally suffers by not providing sample HTTP request amongst the client library sample code. I've put it on hold but my conclusion was I'd simply need to set up a Windows development box and use an HTTPS man-in-the-middle proxy to discover the structure of the request.
    – Koobz
    Jul 18, 2014 at 3:23

1 Answer 1


First of all, a user must be a site collection administrator to be able to grant an app to use app-only policy. Once you have installed and trusted (granted) an app, you can use app only requests to the site or web.

Basically there is an accessToken called App Only Token that you have to create in your code to request app only access. Here is the sample code to create app only access token,

string realm = TokenHelper.GetRealmFromTargetUrl(HostWebUri);
string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, HostWebUri.Authority, realm).AccessToken;

Realm value is your tenant id. Once we have app only access token, Create a client context,

using (var clientContext = TokenHelper.GetClientContextWithAccessToken(HostWebUri.ToString(), accessToken))
   if (clientContext != null)

To understand how it works, Update or create a List Item within host web using app only client context. You will see "SharePoint App" as modified/created by user. Please note that app should have write access on the list in order to update/create list item.

SharePoint bypasses the current user authorization in this case. Obviously, the current user needs to be authenticated in order to be able to perform such operations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.