I want to get a SP2013 list and I can't use CSOM. I've registered my app (a cmd test app, not a SP hosted one) on Sharepoint and have a clientId and clientSecret.

But when I submit the Authorize Url that I built:


I get a http403 on fiddler.


when I request it from a browser I get redirected to:


which is my redirect_uri but with the error "invalid scope". I've tried to use the scope uri (instead of the alias) and got the same response.

Note that I'm also authenticaded when I make the request from the browser. Otherwise I get redirected to the login page.

How can I get an access token to make REST requests to Sharepoint?

Here is a longer description of what I'm trying to do:

I’ve got a sharepoint list at https://mysite.sharepoint.com/. (the location is actually: https://mysite.sharepoint.com/_layouts/15/start.aspx#/Lists/TestTasksList)

And I want to query it from an android app. So far I have and android app built using xamarin to create tasks. I can’t use the client side object model. So the only option is using the Rest Api. I have tried to create a simple .net cmd line app to query the rest api but I can’t find a way to authenticate. I think I need to use OAuth but even after getting the clientId and clientsecret I can’t manage to make requests. I can’t get an access token.

Most code samples that I found are for sharepoint applications to be deployed in the cloud and they seem to ignore the authentication bit (or just using default credentials).

I managed to authenticate and query the list using the CSOM in a .net cmd app. But I can’t find a way to do it using the rest api. I know we can use the legacy web services (from SP2010) but that won’t work as a long term solution.

So the bottom line is querying a list in Office 365 from a console app using the REST api.

  • Did you ever figure out how to use a cmd app to do this? May 9, 2014 at 18:09

3 Answers 3


If you want to write a .NET app that needs operate against SharePoint you can use the code for Microsoft.SharePoint.Client.ClientContext and Microsoft.SharePoint.Client.SharePointOnlineCredentials and then use the CSOM the rest of the way. As you noted you can't do that and need to use the REST api directly.

It seems you need the FedAuth and rtFa cookies to handle the authentication. This is if you want to actually use the session of the user. This is what the Windows Phone SDK is doing in the Authenticator code when using SharePoint Online. http://msdn.microsoft.com/en-us/library/office/jj163079.aspx#SP15Mobileclientauth_advance

If you look at some older code at http://code.msdn.microsoft.com/Remote-Authentication-in-b7b6f43c/sourcecode?fileId=21439&pathId=1615482106, you can see that it is doing essentially that. You'd need to translate this to your other environment.

You seem to be trying to use the authentication of an app (App Auth Policies). There are 3 policies and I think you need the "User-only policy" since the user should be performing these actions.

So you are looking for code like SP2013 Basic Rest Operations look for function RetrieveListItems. This uses a Bearer Access token. The sample code uses the TokenHelper and you can view that code at http://trikks.wordpress.com/2012/12/30/sharepoint-2013-tokenhelper-cs-source-code/. Looking in there at the GetAccessToken methods you need a little more than just the clientId and client secret.

If you want to go the app approach, you will need a user to install or grant permissions to you app on the site. Not sure if this scenario is workable in your solution.

  • 1
    Thanks for your reply. But I don't see where your answer is helpful. Everything that you showed me relies heavily on SP or microsoft libraries. For instance: yes I can recreate my tokenhelper in java. But that has dependencies in other dlls. for ex Microsoft.IdentityModel.S2S.Tokens ! I shouldn't have to be decompilling these dlls to know how to get tokens. if it's standard OAuth it should just send me an access token. I've done this with LinkedIn Rest Apis and it was way easier. Windows phone sdk is easier because, again, it uses csom or other microsoft dlls.
    – Txugo
    Jan 2, 2014 at 11:28
  • I appreciate your comments. Can you give me a little more details about how your application is attempting to operate? Will the user be prompted for credentials to login to SP in the Android App like using my username/password when logging into email? Or are you expecting to have each instance of the app authenticated to operate on behalf of the user? My answer talked about two different approaches, one having the user login similar to what is provided in the Windows Phone SDK and the other using the OAuth model in the SharePoint App model which normally occurs in the context of the browser. Jan 3, 2014 at 6:43

Try this way:


Notice that scope being "List.Read"




There are two ways that can be followed in your case:

-- Using office 365 api which works with azure AD services.

http://msdn.microsoft.com/en-us/library/office/dn605892(v=office.15).aspx http://blogs.msdn.com/b/kaevans/archive/2014/04/15/calling-o365-apis-from-your-web-api-on-behalf-of-a-user.aspx

-- Create your own web Api restful service project which internally talks to sharepoint online via client object model using a standard account. This service you can leverage in your custom build standalone apps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.