I have a Javascript that retrieves the UserCollection from a Site and does some other things from the REST API. This script runs in my own Node.js server.

Currently, I use HTTP Basic Authentication in the script to login to the SharePoint site and then retrieve my data.

To avoid storing username/password in the script, I looked at using OAuth in the script. If I understand correctly, I have to authorize the script to access the REST API by supplying it the Access Token.

Is my approach correct? If yes, how can I obtain the access token (and by extension, the refresh token)?

It seems like most of the tutorials talk about accessing an App that requires authorization, but in my case it is my script.

3 Answers 3


For those who are still looking for the answer - consider sp-request nodejs module.

It allows you to perform OAuth client credentials grant (in different terminilogy it's also called addin-only permissions or application only permissions).

For low-trust apps it uses AzureACS in order to obtain an access token, for high-trust apps (server 2 server auth) it uses certificate for access token generation.


This was the exact problem I was facing. This is an old question but my answer might be helpful to someone else coming here.

It is possible to do OAuth from Node.js or any other web-app. Here are the step by step instructions in my blog -


High Level overview -

1) Get client id and secret by registering yourself here - https://sellerdashboard.microsoft.com/Registration

2) Get Access Token, Refresh Token by following steps here -


  • Hello Yash, I know this is an old question. I am attempting what you describe on your blog above, yet I am using SharePoint 2013, and using the page at /_layouts/15/Appregnew.aspx to get client id and secret. When I go to the next step you describe to get the site realm, the returned page it is invalid. Are there step by step instructions (like you wrote) for SharePoint 2013? Thank you.
    – PaulPerry
    Commented Jul 20, 2017 at 16:38

You shouldn't pass SharePoint credentials directly.

Instead, what you can do is, define credentials for accessing REST API. The credentials can be used to fetch tokens which should be expired after sometime. And with this token you can call other REST methods to access data from your SharePoint.

If the token is not valid, you can declined the request saying unauthorized request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.