I am trying to authenticate with the REST API for a list in SharePoint Online using POSTMAN.

For example, the URL for my site looks something like this:


When I go to the URL for the REST API in browser I can access it fine using my SharePoint Online credentials. I log in and it returns the list of lists in JSON.

When I try to use a GET in POSTMAN it fails with "Access Denied" or it shows the following error:

{"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

Which Authorization type should I be selecting in POSTMAN to authenticate correctly with SharePoint Online?

  • have you found the soultion , i am facing the same problem Commented Feb 19, 2018 at 19:29
  • 1
    Have you register the app and granted appropriate permission? As soon as I remember you will need Auth 2 and acquired a token by providing all the details related to app. Commented Feb 19, 2018 at 21:30
  • @MohamedSahir see answer below. I have just worked through this in POSTMAN and Azure and it works for me. Commented Feb 20, 2018 at 0:04

6 Answers 6


Answering my own question in case it helps somebody.

As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online.

Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to access the SharePoint site.

  • Navigate to Azure AD.
  • Find "App Registrations" in the menu.

    enter image description here

  • Select "New App Registration".

  • Give it a name like SPO or POSTMAN.
  • Select the Application Type to be "Web app / API" and the Sign-on URL to https://www.getpostman.com/oauth2/callback

Once it is registered note the Application ID and copy it to notepad.

  • Go to Required Permissions in the application you just registered.
  • Select SharePoint Online under the Select an API in step 1.
  • Then under 2 Select Permissions, choose "Have full control of all site collections".

Now choose KEYS blade and add a key. The key only shows once when you save it. Copy it to notepad.

  • Go to POSTMAN app on your desktop.
  • Create a new request. For example, https://mytenantname.sharepoint.com/sites/mysitecollection/_api/web/lists
  • Set a header of "Accept: application/json; odata=verbose"

  • Go to the Authorization tab in POSTMAN.

  • Select Oauth 2.0 from the dropdown and press the Get New Access Token.

Fill out the fields in that dialog like below:

Auth URL :           https://login.microsoftonline.com/common/oauth2/authorize?resource=https://mytenantname.sharepoint.com  
Access Token URL :   https://login.microsoftonline.com/common/oauth2/token  
Client ID :          <Application_ID>  
Client Secret :      <KEY>  
Grant Type :         Authorization Code

Click Request Token button.

At this point you should login with an admin user. You will also be asked to allow the permissions you set on the Application in Azure AD. This is why you need to log in as an Admin account. Accept the permissions request when asked.

The token is returned. Copy it to notepad and then click the "Use Token" button. This fills in the token to the correct place in POSTMAN.

Now Send your request and you should have a successful returned JSON list of lists.

In addition to above I have found that I need to create a certificate in order to authenticate. Just registering the app and giving permissions was not enough.

To do this check out the makecert command in a Visual Studio Developer command prompt. Example below:

makecert -r -pe -n "CN=POSTMAN-TEST" -b 12/15/2014 -e 12/15/2016 -ss POSTMAN-TEST -len 2048
  • Then go to mmc.exe and the Personal folder in the Certificates snap in.
  • Export the cert you created with the command above to a .CER file.
  • Then go to Azure Portal and your registered app that you did above.
  • Download the manifest file.
  • Replace the section for the key credentials in the manifest file and upload it back to the app registration in Azure.

For example put your values from your CER file into this section:

"keyCredentials": [
  "customKeyIdentifier": "$base64Thumbprint_from_above",
  "keyId": "$keyid_from_above",
  "type": "AsymmetricX509Cert",
  "usage": "Verify",
  "value":  "$base64Value_from_above"
  • The formatting in my answer is terrible I know. I will try to correct and make it more legible. Commented Feb 22, 2018 at 21:46
  • I wanted to comment but was unable to due to not having required reputation. I was following your steps but got stuck towards the end when you say to export the cert. I used your example to create the cert but I dont see anything in the mmc.exe that looks like that cert. Am I looking in the right place? Commented Nov 9, 2018 at 15:48
  • you may need to add the snap in to your mmc console. I couldn't find the certs I created initially either so I played around with adding & expanding the various certificate locations. Commented Nov 9, 2018 at 15:54
  • so i added the certificate snap-in but still dont see the created certs Commented Nov 9, 2018 at 15:55

I've successfully achieved it using this tutorial.

Sharepoint configuration part

  1. Register a new app by

    • following https://YourTenant.sharepoint.com/_layouts/15/appregnew.aspx link
    • generating Client Id and ** Client Secret** values
    • filling Title, App Domain and Redirect URI fields (I've input localhost.com as on the picture - it works)
    • clicking Create button enter image description here
  2. Save somewhere into file the next parameters:

     The app identifier has been successfully created.
     Client Id:      898c898f-89238-43d0-4b2d-7a64c26f386a
     Client Secret:  4/T+21I1DSoAJdOX9DL1Ne4KssEaP7rqb11gdtskhXn=
     Title:          SomeTitle
     App Domain:     localhost.com
     Redirect URI:   https://localhost.com/default.aspx
  3. Apply permissions to this app by

    • following https://YourTennant.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

    • inserting Client Id: 898c898f-89238-43d0-4b2d-7a64c26f386a into App Id field

    • clicking Lookup button

    • pasting into Permission Request XML the next code (in my case I needed only Read access, so I changed Rights value from FullControl to Read):

        <AppPermissionRequests AllowAppOnlyPolicy="true">
          <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
    • Create bottom button clicking enter image description here

    • Trust it button clicking

Postman configuration part

  1. Open postman and create aGET request

    • with a similar URI:

    • with the header:

        KEY               VALUE
        Authorization     Bearer

You'll get an error which you should ignore:

    <?xml version="1.0" encoding="utf-8"?>
    <m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata">
        <m:code>-2147024891, System.UnauthorizedAccessException</m:code>
        <m:message xml:lang="en-US">Access denied. You do not have permission to perform this action or access this resource.</m:message>
  1. Go to response's Headers tab and click the WWW-Authenticate key's value

  2. Copy and save these parameters:

     Bearer realm="a998899-ad83-234a-af83-8238af989898" #SharePoint Online Tennant Id
     client_id="00000003-0000-0ff1-ce00-000000000000"   #Resource information value

enter image description here

  1. Open a new Postman's tab and create new POST request by
    • selecting POST request type

    • pasting URI: https://accounts.accesscontrol.windows.net/"Bearer realm value without double quotes here"/tokens/OAuth/2

    • adding header (on Headers tab):

        KEY               VALUE
        Content-Type      application/x-www-form-urlencoded
    • adding body key/value parameters (on Body tab):

        KEY               VALUE
        grant_type        client_credentials
        client_id         ClientID or AppId value@Bearer realm value
        client_secret     ClientSecret value
        resource          resource/YourTenant.sharepoint.com@Bearer realm value
        KEY               VALUE
        grant_type        client_credentials
        client_id         898c898f-89238-43d0-4b2d-7a64c26f386a@a998899-ad83-234a-af83-8238af989898
        client_secret     4/T+21I1DSoAJdOX9DL1Ne4KssEaP7rqb11gdtskhXn=
        resource          00000003-0000-0ff1-ce00-000000000000/contoso.sharepoint.com@a998899-ad83-234a-af83-8238af989898

enter image description here

  1. Click Send button and copy your access_token on response's Body tab.

  2. Open a new Postman's tab and create a new GET request by

    • pasting URI: https://YourTenant.sharepoint.com/_api/web

    • adding headers on Headers tab:

        KEY            VALUE
        Authorization  Bearer eyJ0eXAiOiJKV1Q-verylongstring-0GFpSYw
        Accept         application/json;odata=verbose
  3. Execute this request and get results:

enter image description here

More automated and simpler results retrieving method using bash & curl (Linux)

  • 1
    Best answer! If I could upvote this 10 times I would. Thank you for the detailed write-up, you saved me a TON of time!
    – LawMan
    Commented Jul 2, 2020 at 12:47
  • @LawMan Glad it helped you) You're welcome)
    – Gryu
    Commented Jul 2, 2020 at 13:11
  • Any idea what to do if WWW=Authenticate has NTLM instead of Bearer realm?
    – NoobNewb
    Commented Jan 28, 2021 at 21:11
  • This one's really useful. Thank you! :)
    – aj go
    Commented Jul 2, 2021 at 12:21

Just adding this here since the Azure Portal is slightly different now.

  1. Login to Azure Portal at https://portal.azure.com for your O365 Tenant
  2. Either use the Search at the top of the page for App registrations or Select All Services > Scroll down to Identity and Select App registrations
  3. Select New Registration
  4. Give it a name, Change the account type to which ever you prefer, in this case I just used Accounts in this organizational directory only
  5. (Optional) Enter in a Redirect URL - I used : https://login.microsoftonline.com/common/oauth2/nativeclient
  6. Select Register
  7. On Overview blade copy the Application (client) ID
  8. Select the Certificates & Secrets blade
  9. Select New client secret
  10. Give description and set expiry date if required and Select Add
  11. After selecting Add, make sure you copy the Value generated to your clipboard, otherwise you'll have to generate a new one.
  12. Set Permissions you require on the API permissions blades, here I just added Sharepoint - AllSites.Read
  13. You can now build your REST request
  • 1
    Thanks great solution. Could you please provide what are the tokens key you are using it in POSTMAN. Commented Jan 7, 2020 at 20:12

If you're using Microsoft Graph API to access SharePoint Online, you'll find the Microsoft Graph Postman collection helpful too. It supports both application and on-behalf-of API calls.

Also on YouTube: Getting started with Microsoft Graph Postman Collections.


Just to clarify a part of motionpotion's solution (would comment but not high enough rep), the values for the Azure AD Manifest have to be converted before updating.

I followed the guide below which uses Powershell for certificate generation and converting the individual properties to base64, before putting them in Json format for pasting into the manifest.

$cert = New-SelfSignedCertificate -Subject "CN=POSTMAN-TEST" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature

$bin = $cert.RawData

$base64Value = [System.Convert]::ToBase64String($bin)

$bin = $cert.GetCertHash()

$base64thumbprint = [System.Convert]::ToBase64String($bin)

$keyid = [System.Guid]::NewGuid().ToString()

$jsonobj = @{customKeyIdentifier=$base64thumbprint;keyId=$keyId;type="AsymmetricX509Cert";usage="Verify";value=$base64Value}

$keyCredentials = ConvertTo-Json @($jsonobj)

The output of $keyCredentials will be the same as motionpotion's:

"keyCredentials": [ { "customKeyIdentifier": "$base64Thumbprint_from_above", "keyId": "$keyid_from_above", "type": "AsymmetricX509Cert", "usage": "Verify", "value": "$base64Value_from_above" } ],



enter image description hereyou can use Postman Interceptor for this scenario

Postman Interceptor helps you send requests which use browser cookies through the Postman app. It can also send headers which are normally restricted by Chrome but are critical for testing APIs. The Interceptor makes this process painless. Something that would have required a proxy earlier can now be achieved without any installation steps or extra configuration.

Postman Interceptor

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.