I am currently using my account's credentials to run some custom code in my SharePoint Online provider-hosted Add-in.

I am passing the credentials this way:

SecureString passWord = new SecureString();
foreach (char c in "my password here".ToCharArray()) passWord.AppendChar(c);

clientContext.Credentials = new SharePointOnlineCredentials("my login here", passWord);

This works just fine, but is there a way I could use current user's credentials instead, without hard-coding login and password?

clientContext.Credentials = ???



I've tried

clientContext.Credentials = clientContext.Web.CurrentUser.Context.Credentials;

But I get "error: (403) Forbidden" this way...

  • Check this MSDN link msdn.microsoft.com/en-us/library/office/…
    – Hardik
    Apr 11, 2016 at 11:03
  • @Hardik , this way I get "error: (401) Unauthorized"
    – Gintas K
    Apr 11, 2016 at 11:15
  • 1
    You can get your credentials from web.config so you do not need to hard-code in code behind.
    – Hardik
    Apr 11, 2016 at 11:55
  • @Hardik , I've tried it but then I get "error: (403) Forbidden"
    – Gintas K
    Apr 11, 2016 at 12:02
  • If you're using a provider-hosted add-in, why not use the SharePointContextProvider and TokenHelper classes?
    – wjervis
    Apr 11, 2016 at 12:20

3 Answers 3


I've read a few articles about the topic linked here and a bit curious no one yet has mentioned yet the Windows Credentials Manager.

This is my code to read/write from SharePoint from an application installed as Windows Service:

        NetworkCredential networkCredentials = WebCredentialMgr.GetCredential(sharePointUser);
        T result = default(T);
        using (var clientContext = new ClientContext(sharePointUri))
             if (networkCredentials != null && !string.IsNullOrEmpty(networkCredentials.UserName))
            {   // works only when stored in the 'Web Credentials' not as Windows Credentials :(
                clientContext.Credentials = new SharePointOnlineCredentials(networkCredentials.UserName, networkCredentials.SecurePassword);
            {   // default code from MSDN, does not work for SharePoint Online
                clientContext.AuthenticationMode = ClientAuthenticationMode.Default;
                clientContext.Credentials = CredentialCache.DefaultCredentials;
            result = action(clientContext);


using System.Collections.Generic;
using System.Net;
using Windows.Security.Credentials;

public static class WebCredentialMgr
    public static NetworkCredential GetCredential(string userName)
        PasswordCredential credential = GetCredentialFromLocker(userName);
        if (credential == null)
            return null;


        var networkCred = new NetworkCredential(credential.UserName, credential.Password);
        return networkCred;

    private static PasswordCredential GetCredentialFromLocker(string userName)
        PasswordCredential credential = null;
        IReadOnlyList<PasswordCredential> credentialList = null;

        var vault = new PasswordVault();
            credentialList = vault.FindAllByUserName(userName);
             // log error  
        if (credentialList == null)
            credentialList = vault.RetrieveAll();

        if (credentialList != null && credentialList.Count > 0)
            if (credentialList.Count == 1)
                credential = credentialList[0];
                // manage issue when multiple user names
        return credential;

Log once in your SharePoint site with the wished credentials, and let Internet Explorer remember your password: it will be saved into Windows Web Credentials. And using the code above, you can simply read it from your program.

  • This almost worked for me... But I eventually got Microsoft.SharePoint.Client.IdcrlException: 'The partner returned a bad sign-in name or password error. For more information, see Federation Error-handling Scenarios.' I suppose this doesn't work in 2-factor auth scenarios.
    – Jonathan
    Jun 26, 2017 at 11:16
  • not able to find Windows.Security.Credentials, any help?
    – Anil Pal
    Aug 2, 2018 at 12:14

The only tricky part for accessing SharePoint Online from the Client Object Model will be the authentication. There is no direct method of authenticating with SharePoint Online from the CSOM so Microsoft has released a work around.

You can find the details and code here: http://blogs.msdn.com/b/cjohnson/archive/2011/05/03/authentication-with-sharepoint-online-and-the-client-side-object-model.aspx

So what it basically does is:

  1. Opens up a browser Instance
  2. Authenticates with the browser
  3. Grabs the authentication cookie and passes it to the Client Object Model.

The rest of the tasks should be quite straight forward. You can find many code samples here: http://msdn.microsoft.com/en-us/library/ee537013.aspx

UPDATE: You this technique to allow the authentication to happen without a human running the console app: http://blogs.msdn.com/b/cjohnson/archive/2011/05/14/part-2-headless-authentication-with-sharepoint-online-and-the-client-side-object-model.aspx

  • As you can see in my question, I have the working code. I don't want to hard-code credentials anywhere. I need to use current user's credentials as the add-in will be used by other people as well.
    – Gintas K
    Apr 11, 2016 at 12:13
  • Please check this vrdmn.com/2013/01/…
    – Hardik
    Apr 11, 2016 at 12:23
  • yes, I use this code at the moment, but I don't want ANY hard-coded credentials in my code
    – Gintas K
    Apr 11, 2016 at 12:31
  • Please find my updated answer.
    – Hardik
    Apr 11, 2016 at 12:43
  • Hello Gintas, Is that working for you?
    – Hardik
    Apr 12, 2016 at 10:27

The recommended solution from Microsoft for a service application is however via a dedicated token for that app via a x509 certificate: https://msdn.microsoft.com/en-us/office/office365/howto/building-service-apps-in-office-365

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.