I'm creating my first app for SharePoint 2013. I follow this MSDN article, that explains how to create autohosted app.

This piece of code I took from the article and didn't change anything in it.

protected void Page_Load(object sender, EventArgs e)
    string contextTokenString = TokenHelper.GetContextTokenFromRequest(Request);

    if (contextTokenString != null)
        // Get context token
        contextToken = TokenHelper.ReadAndValidateContextToken(contextTokenString, Request.Url.Authority);

        // Get access token
        sharepointUrl = new Uri(Request.QueryString["SPHostUrl"]);
        accessToken = TokenHelper.GetAccessToken(contextToken, sharepointUrl.Authority).AccessToken;

        // Pass the access token to the button event handler.
        Button1.CommandArgument = accessToken;

However, when I run my deployed app, I get SecurityTokenException: Invalid issuer or signature.

Any advice how to solve this error would be appreciated.

 [SecurityTokenException: Invalid issuer or signature.]
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.VerifySignature(String signingInput, String signature, String algorithm, SecurityToken signingToken) +873
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken) +498
   Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadToken(String token) +7
   SharePoint_AutohostedApp1Web.TokenHelper.ReadAndValidateContextToken(String contextTokenString, String appHostName) in c:\Users\tsch\Documents\Visual Studio 2012\Projects\SharePoint-AutohostedApp1\SharePoint-AutohostedApp1Web\TokenHelper.cs:75
   SharePoint_AutohostedApp1Web.Pages.Default.Page_Load(Object sender, EventArgs e) in c:\Users\tsch\Documents\Visual Studio 2012\Projects\SharePoint-AutohostedApp1\SharePoint-AutohostedApp1Web\Pages\Default.aspx.cs:24
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +51
   System.Web.UI.Control.OnLoad(EventArgs e) +92
   System.Web.UI.Control.LoadRecursive() +54
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +772
  • Tschareck, could you post what you did to solve this issue. I'm running into same issue deploying the same demo app and haven't found a fix yet. Thanks Commented Jan 8, 2013 at 23:37

2 Answers 2


I'm assuming you have already found a way around this issue, but I resolved it by editing the permissions my App needed to the Host Web. Originally I was just leaving it blank, but setting those permissions explicitly in the manifest got it working.

  • this did it for me. I constantly am forgetting to request access to the web. Weird for me is that I was able to connect without the permission, then it magically stopped working. Commented Feb 6, 2013 at 5:26
  • My comment doesn't stand entirely. This seems to be a caching issue perhaps. Commented Feb 6, 2013 at 6:20

Here's how I fixed it in my case.

Uninstall the app, then in the Office 365 Admin Center, click apps then App Permissions. Delete any app permissions left behind for your app, and install the app again.

I think what was happening was that it was using the wrong set of permissions and sending the app an invalid token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.