I have the following code in my SharePoint add-in (SharePoint Online). Simple code just to load the list items, the code works fine
$.ajax({
url: appweburl + "/_api/web/lists/getbytitle('MyList')/items",
type: "GET",
headers: { "Accept": "application/json;odata=verbose" },
cache: false,
success: function (data) {
alert('Successfully obtained data.');
},
error: function (data) {
alert(data);
}
});
My confusion is, I am not passing any access token and from what I know the access token is required to let the add-in access data. So how is this working?