I have the following code in my SharePoint add-in (SharePoint Online). Simple code just to load the list items, the code works fine

        url: appweburl + "/_api/web/lists/getbytitle('MyList')/items",
        type: "GET",
        headers: { "Accept": "application/json;odata=verbose" },
        cache: false,
        success: function (data) {
            alert('Successfully obtained data.');
        error: function (data) {

My confusion is, I am not passing any access token and from what I know the access token is required to let the add-in access data. So how is this working?

1 Answer 1


The browser passes over the FedAuth cookie with the XHR request, and that authenticates you.

  • But FedAuth only appears in some condition (FBA, ADFS etc), In my configuration there's no FedAuth, do you know how the rest API is authenticated in SharePoint in that case (windows claims + NTLM)?, see my post sharepoint.stackexchange.com/questions/184214/…
    – Wint
    Jun 27, 2016 at 9:23
  • If you're using NTLM it'll be using the Bearer HTTP Header.
    – James Love
    Jun 27, 2016 at 13:00
  • In my environment the SharePoint pages are authenticated in standard NTLM procedure (server respond with WWWAuthenticate: NTLM and so on), however, after authenticated, I cannot find any token like things in subsequent successful api call. (I have manually cleared cookie WSS_KeepSessionAuthenticated), I wonder how SharePoint authenticate/associate these api call with current user. I can post a new question if my description is not clear here and invite you, Thanks a lot!
    – Wint
    Jun 27, 2016 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.