I have a client app written in WindowsRT which connects with SharePoint Office365 server trough webservices. The way I am doing this now is sending user name and password to webservices and then they authenticate with SharePoint, get data and pass it back to the client app.

_clientContext = new ClientContext(hostUrl)
    Credentials = new SharePointOnlineCredentials(userName, securePassword)

Could anyone provide some idea/spec/link which will explain how to avoid sending username and password with every request to webservices?

I want to replace them with an authentication token. That way the client app would receive an auth token from SharePoint server then pass it to the webservice, which will use it to communicate with SharePoint on my behalf. Because it is not nice/secure to send user name and password.


You can use Office 365 APIs which support native applications running on Windows 8, iOS etc. and consume Office 365 using REST APIs and OAuth.

One of the concerns in building such apps is how to find user specific endpoints for the various Microsoft services like OneDrive for business, SharePoint etc. You just need to pass the user identity, and Office 365 APIs will get the endpoints to the service using discovery services. So you will get:

  1. Consume Office 365 using REST/OData & OAuth
  2. Supports SharePoint, Exchange & AD in O365
  3. Windows 8, iOS, Android, Web applications
  4. Endpoints found through service discovery

Remember, these APIs are still in preview version so changes might come.

Here is a really good tutorial on building native apps with Office 365


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.