How to Fix getAccessToken Failures in a Sideloaded Outlook Add-In

• Overview of Single Sign-On (SSO) architecture in Office Add-ins and the role of the Office.auth.getAccessToken method.
• Common symptoms of token failures during the development phase (e.g., error codes 13000, 13003, 13005, 13012).
• Why sideloaded add-ins experience unique authentication hurdles compared to store-deployed add-ins (manifest discrepancies, caching, local testing environments).
• Purpose of this guide: Providing the practical list of tools and configurations to demonstrate exactly fixing getAccessToken Failures in a Sideloaded Outlook Add-In.

5 Ways to Fix getAccessToken Failures in a Sideloaded Outlook Add-In

1. Microsoft Entra ID (Azure Portal) App Registrations

• The vast majority of SSO failures stem from misconfigured application manifests, missing API permissions, or incorrect "Expose an API" settings. Checking here is step one for fixing getAccessToken Failures in a Sideloaded Outlook Add-In.
• Token configuration, scope definition (access_as_user), and pre-authorized client application management.
• Directly addresses the root cause of 13005 (Invalid Grant) and 13012 (API Not Supported) errors; provides a single source of truth for identity.
• Interface is complex for beginners; directory synchronization delays can cause false-positive error readings.

2. Outlook on the Web (OWA) Developer Tools

• Testing a sideloaded add-in in the desktop client masks underlying network errors. Using OWA allows developers to inspect the raw console output while working on fixing getAccessToken Failures in a Sideloaded Outlook Add-In.
• Browser-based Network tab, Console logging, and local storage inspection.
• No extra software required; exposes exact CORS errors or HTTP 401/403 responses from the Microsoft identity platform.
• Only tests the web environment; desktop-specific SSO cache issues will not be visible here.

3. jwt.ms (JSON Web Token Decoder)

• When getAccessToken succeeds but the backend rejects the token, decoding the payload is necessary to see if the claims are correct. This is critical for end-to-end knowledge on fixing getAccessToken Failures in a Sideloaded Outlook Add-In.
• Base64 decoding, claim descriptions, and audience (aud) verification.
• Free, instant, and provides Microsoft-specific claim explanations natively.
• Only useful if a token is actually returned; does not help with client-side 13003 (User Not Logged In) errors.

4. Fiddler Classic / Fiddler Everywhere

• Sometimes desktop Outlook silently drops the authentication request. A network proxy intercepts the traffic, providing a clear path on fixing getAccessToken Failures in a Sideloaded Outlook Add-In on Windows/Mac.
• HTTPS decryption, session inspection, and traffic replay.
• Captures hidden background traffic between Outlook.exe and login.microsoftonline.com.
• Requires installing root certificates which can trigger corporate firewall or antivirus alerts.

5. Microsoft 365 CLI (Command Line Interface)

• Validating the XML manifest against your Azure App Registration manually is error-prone. The CLI automates validation, serving as a proactive measure for fixing getAccessToken Failures in a Sideloaded Outlook Add-In.
• Automated manifest validation, tenant state checking, and deployment scripting.
• Catches typo-based errors in the section before sideloading even happens.
• Requires Node.js installation and familiarity with terminal commands.

Compare Methods for Fixing getAccessToken Failures in a Sideloaded Outlook Add-In

Use WPS Office for Local Files Related to Fixing getAccessToken Failures in a Sideloaded Outlook Add-In

• Clarification on Scope: Because token exchange, SSO configurations, and sideloading mechanics are strictly controlled by Microsoft Entra ID and the Outlook client architecture, WPS Office cannot change these Microsoft-side settings or directly fix the getAccessToken API call.
• Where WPS Office Fits: Once you have successfully resolved fixing getAccessToken Failures in a Sideloaded Outlook Add-In, your add-in will likely process, download, or generate document attachments (Word, Excel, or PDF). WPS Office serves as an excellent, lightweight alternative for interacting with these extracted files.
• WPS Office Workflow:
  • Step 1: Use your functional Outlook Add-in to extract the target document or attachment from the email.
  • Step 2: Open the extracted file locally using WPS Office. Its high compatibility with .docx, .xlsx, and .pptx formats ensures your dynamically generated data renders exactly as intended.
  • Step 3: Utilize WPS Office's built-in PDF toolkit to compress or convert the extracted reports before distributing them further, streamlining your downstream document management without needing heavy, expensive software suites.

Use Word, Excel, and PPT for FREE

Free Download

FAQs About Fixing getAccessToken Failures in a Sideloaded Outlook Add-In

Why does getAccessToken return error 13003 when testing locally?

Error 13003 means the user is not logged into Office, or their identity cannot be verified. When debugging fixing getAccessToken Failures in a Sideloaded Outlook Add-In, confirm that the testing account is signed into the Outlook desktop client as the primary account, and that modern authentication is enabled on the tenant.

How do I resolve the "Invalid audience" error during token exchange?

This occurs when the URL in your XML manifest does not correctly match the Application ID URI in Azure. To fix this, navigate to your App Registration in Entra ID, go to "Expose an API," and ensure the URI identically mirrors the manifest, typically formatted as api://localhost:3000/.

Can clearing the Office cache help fix token failures?

Yes. Outlook aggressively caches sideloaded manifests and outdated SSO tokens. A crucial step in fixing getAccessToken Failures in a Sideloaded Outlook Add-In is deleting the contents of %LOCALAPPDATA%\Microsoft\Office\16.0\Wef\ or using the "Clear Cache" option in the Office Add-ins personality menu.

Why does my add-in work in OWA but fail in Outlook Desktop?

Browser environments (OWA) rely on standard web cookies for SSO, whereas Outlook Desktop requires the application to bridge Windows identity with the add-in framework. Desktop failures usually indicate a missing pre-authorized client application (ID: d3590ed6-52b3-4102-aeff-aad2292ab01c for Microsoft Office) in your Azure portal's "Expose an API" settings.