OAuth 2.0 Authentication for Office Add-ins

OAuth 2.0 is the auth standard behind almost every API an Office add-in might connect to: Microsoft Graph, Salesforce, Google, custom internal APIs, and any SaaS platform built in the last ten years. Implementing it correctly inside an Office add-in is harder than implementing it in a standard web app because the Office task pane is a sandboxed environment with restrictions on how popup windows work, where tokens can be stored, and what happens when the add-in is closed and reopened.

We implement OAuth 2.0 for two main scenarios. The first is Microsoft 365 authentication using the authorization code flow with PKCE via MSAL, the correct flow for add-ins that need to authenticate users against Azure AD without relying on the SSO getAccessToken approach. The second is third-party OAuth: connecting the add-in to Salesforce, Google, HubSpot, or any other OAuth 2.0 provider using the authorization code flow and handling the callback, token storage, and refresh cycle within the Office add-in architecture.

Both scenarios require a server-side component for the token exchange. Storing OAuth tokens in localStorage inside the Office task pane is not secure and fails in some Office environments. We build the server-side token endpoint and caching layer so tokens are handled correctly and the add-in reconnects automatically after a session ends.