There are a myriad of references to how to generate ClientId and ClientSecret to register an app when working with the SharePoint appmodel. However, I can't seem to find any good documentation explaining exactly how these are used.

The fact that it is called "secret" seems to indicate that it is probably used in some fashion to secure communications between SharePoint and the app.

However, I am a bit confused as to where this is used in the communication process and how to securely manage the id and secret.

I primarily work with provider-hosted apps.

Is the secret used for encryption? For token signing? Should it only be known to the publisher of the app? Or only to the environment where the app is installed? Or is it a shared secret between the both provider and SharePoint installation environment? If the latter, then how is it managed so that different installations for different companies don't leak the secret?


One reason why the Client Secret and Client Id should be protected is in cases where the application has been granted the ability to make calls using the application principal (aka AllowAppOnlyPolicy="true").

In this case, an application can obtain an access token and call into SharePoint using only the Client Secret and the Client Id. If AllowAppOnlyPolicy is not enabled, then an access token (via a refresh token) is only granted as part of a flow which requires user authentication to the resource in SharePoint. In the latter case, protecting of the Client Id and Client Secret is not as important.

I came across your post while searching for a way to generate a unique client secret for each installation of an app from the Office store. No luck on that yet.

| improve this answer | |

You can see the use of ClientId and ClientSecret in the TokenHelper class:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.