Integrate with Office for the web

  • Article

You can integrate with Office for the web to enable your users to view and edit Excel, PowerPoint, and Word files directly in the browser.

Important

The Office 365 - Cloud Storage Partner Program is for independent software vendors whose business is cloud storage. It's not open to Office 365 customers directly.

If you deliver a web-based experience that lets your users store Office files or include Office files as a key part of your solution, you can integrate Office for the web into your experience. This integration works directly on files stored by you. Your users won’t need a separate storage solution to view and edit Office files.

Figure 1 Word file open for editing in Office for the web

Figure 1 - Word file open for editing in Office for the web

View Office files

Important

Participants in the Office 365 - Cloud Storage Partner Program must support document editing and multi-user co-authoring.

You can make viewing available in two ways:

  • By using the high-fidelity previews in Office for the web as an integrated part of your experience. For example, you can use these previews in a light box view of a Word document.
  • By offering to show Office files in a full-page interactive preview. Depending on your solution, this might be useful for file browsing or showing read-only files or in cases where users don’t have a license to edit files in Office for the web.

Edit Office files

Editing is a core part of Office for the web integration. When you integrate with Office for the web, your users can edit Excel, PowerPoint, and Word files directly in the browser. Also, they can edit documents collaboratively with other users using Office. To edit documents, users require an Office license. For more information, see Co-authoring using Office for the web.

Integration process

Integrating with Office for the web includes some HTML and JavaScript work and setting up a few simple REST endpoints. If you're familiar with existing Office protocols, note that you don’t have to implement the [MS-FSSHTTP]: File Synchronization via SOAP over HTTP Protocol (Cobalt). At a high level, to integrate with Office for the web, you:

  • Read XML from Office for the web that describes the capabilities of Office for the web. This is called WOPI discovery.
  • Implement REST endpoints that Office for the web uses to learn about, fetch, and update files. To do this, you implement the server side of the WOPI protocol.
  • Provide an HTML page (or pages) that wrap Office for the web. This page is called the host page.

The following figure shows the WOPI protocol workflow.

Figure 2 WOPI protocol workflow

Figure 2 - WOPI protocol workflow

Your solution must meet the following basic requirements.

Authentication

Authentication is handled by passing Office for the web an access token that you generate. Assign this token a reasonable expiration date. Also, we recommend that tokens are only valid for a single user against a single file, to help mitigate the risk of token leaks. For more information, see Access token.

Conflict resolution

Office for the web supports multiuser authoring scenarios if all users are using Office for the web. However, you're responsible for managing conflicts that might come from applications other than Office for the web. You'd want to set up some form of file locking or use another type of conflict resolution.

File IDs

Ensure that files are represented by a persistent ID. This ID must be URL-safe because it might be passed as part of the URL at different times. Also, the ID can't change when the file is renamed, moved, or edited. This ensures an uninterrupted editing experience for your users. For more information, see File ID.

File versions

You should have a mechanism for users to clearly identify file versions through the REST APIs. Because files are cached to improve viewing performance, file versions are extremely helpful. Without them, users can’t easily determine whether they have the latest version of the file.

Consider security

Office for the web is designed to work for enterprises that have strict security requirements. To make your integration as secure as possible, be sure that:

  • All traffic is SSL encrypted.
  • Initial requests to Office for the web are made by using POST, where the access token is in the body of the POST request.

Set up Office for the web identity by using a public proof key to decrypt part of the WOPI requests. Also, the file cache indexes store file contents by using a SHA256 hash as the cache key. You can pass the hash value to Office for the web by using the SHA256 property in the CheckFileInfo response. If not provided, Office for the web generates a cache key from the file ID and version. To ensure that users don't force a cache collision and view the wrong file, none of the user-provided information should generate the cache key.

Manage Office 365 subscriptions

Important

The Office 365 - Cloud Storage Partner Program doesn't support Government Licenses

Business users require an Office 365 subscription to edit files in Office for the web. The best way to support this is to have users sign in with a Microsoft account or other valid identity. This establishes that they have the correct subscription. To limit the number of times a user needs to sign in, Office for the web first checks for a cookie.

To provide a better experience for users with Office 365 subscriptions, hosts can optionally implement the PutUserInfo WOPI operation. For more information, see Tracking users’ subscription status.

Interested?

If you’re interested in integrating your solution with Office for the web, take a moment to register at Office 365 Cloud Storage Partner Program.