IMPORTANT UPDATE – PLEASE READ : It looks like as of May 1, 2018 Microsoft made changes that invalidate the techniques shown in this post. Attempting to exchange the access token received by the user interface with an access token that can be used to interact with SharePoint now fails with the following error message: “AADSTS240002: Input id_token cannot be used as ‘urn:ietf:params:oauth:grant-type:jwt-bearer’ grant”. I am going to investigate this issue and post my findings here. I will update this post or I will write a new post when I find a viable alternative solution. I recently answered a Question on SharePoint Stack Exchange . I’ve spent quite a bit of time looking at this problem over the last week or two so I thought I’d share what I’ve found in a blog post. I’d like to highlight the three blog posts that helped me the most in my research. In terms of building the Web API, I used a blog post by Koen Koninckx entitled Securing Your Web API . In terms of the Jav...