Table of Contents

Class OAuthAuthorizationCodeClient

Namespace
BpNexT.NET.GraphQL.Client.OAuth
Assembly
BpNexT.NET.GraphQL.dll

Low-level client for the OAuth 2.0 authorization code flow with PKCE (RFC 6749 + RFC 7636) against the microtech ERP authorization server. Handles URL building, code exchange, and token refresh — no browser interaction and no caching. For a one-call desktop login use InteractiveBrowserLogin; for automatic caching and refresh wrap the results in an AuthorizationCodeTokenProvider.

public class OAuthAuthorizationCodeClient
Inheritance
object
OAuthAuthorizationCodeClient

Remarks

Supports public clients (no secret; client_id is sent in the request body) and confidential clients (secret; credentials are sent as a Basic authorization header).

Constructors

OAuthAuthorizationCodeClient(string, string, string, string?, HttpClient?, ILoggerFactory?)

Initializes a new instance of the OAuthAuthorizationCodeClient class.

public OAuthAuthorizationCodeClient(string authorizeEndpoint, string tokenEndpoint, string clientId, string? clientSecret = null, HttpClient? httpClient = null, ILoggerFactory? loggerFactory = null)

Parameters

authorizeEndpoint string

The authorization endpoint URL.

tokenEndpoint string

The token endpoint URL.

clientId string

The OAuth client ID.

clientSecret string

The client secret for confidential clients, or null for public clients.

httpClient HttpClient

Optional HTTP client instance. When provided, its lifetime is owned by the caller. Note: LoginWithBasicAuthAsync(string, string, string, string, CancellationToken) requires a client that does not follow redirects (AllowAutoRedirect = false).

loggerFactory ILoggerFactory

Optional logger factory. If null, SDK logging is disabled for this client.

Methods

BeginAuthorization(string, string)

Starts an authorization code flow whose callback is hosted by the consumer (e.g. an ASP.NET controller): generates PKCE values and state and returns a session exposing the AuthorizeUrl to redirect the user to; complete it in the callback via CompleteAsync(string, CancellationToken).

public GraphQlAuthorizationSession BeginAuthorization(string redirectUri, string scope = "graphql")

Parameters

redirectUri string

The callback URI hosted by the consumer; must be registered for the client.

scope string

The requested scope.

Returns

GraphQlAuthorizationSession

BuildAuthorizeUrl(string, string, string, string)

Builds the URL of the authorization request the user has to open in a browser.

public string BuildAuthorizeUrl(string redirectUri, string codeChallenge, string state, string scope = "graphql")

Parameters

redirectUri string

The redirect URI registered for the client.

codeChallenge string

The PKCE S256 code challenge (see CreatePair()).

state string

Random state value; validate it against the redirect for CSRF protection.

scope string

The requested scope.

Returns

string

ExchangeCodeAsync(string, string, string, CancellationToken)

Exchanges an authorization code for a token set.

public Task<GraphQlTokenSet> ExchangeCodeAsync(string code, string codeVerifier, string redirectUri, CancellationToken cancellationToken = default)

Parameters

code string

The authorization code received on the redirect URI.

codeVerifier string

The PKCE code verifier matching the challenge of the authorization request.

redirectUri string

The redirect URI used in the authorization request.

cancellationToken CancellationToken

Token to cancel the request.

Returns

Task<GraphQlTokenSet>

Exceptions

GraphQlAuthenticationException

Thrown when the token endpoint rejects the request.

FromGraphQlEndpoint(string, string, string?, HttpClient?, ILoggerFactory?)

Creates a client with the authorize and token endpoints derived from a microtech ERP GraphQL endpoint: a trailing /graphql/v1 is replaced by /authorize and /token respectively.

public static OAuthAuthorizationCodeClient FromGraphQlEndpoint(string graphQlEndpoint, string clientId, string? clientSecret = null, HttpClient? httpClient = null, ILoggerFactory? loggerFactory = null)

Parameters

graphQlEndpoint string

The GraphQL endpoint URL (ending in /graphql/v1).

clientId string

The OAuth client ID.

clientSecret string

The client secret for confidential clients, or null for public clients.

httpClient HttpClient

Optional HTTP client instance. When provided, its lifetime is owned by the caller.

loggerFactory ILoggerFactory

Optional logger factory. If null, SDK logging is disabled for this client.

Returns

OAuthAuthorizationCodeClient

LoginWithBasicAuthAsync(string, string, string, string, CancellationToken)

Runs the complete authorization code flow with PKCE without a browser by authenticating the user directly at the authorize endpoint with HTTP Basic auth (microtech ERP username and password). The authorization code is read from the redirect Location header — the redirect URI is never visited, so nothing needs to listen on it. Suitable for headless hosts such as Windows services.

public Task<GraphQlTokenSet> LoginWithBasicAuthAsync(string username, string password, string redirectUri, string scope = "graphql", CancellationToken cancellationToken = default)

Parameters

username string

The microtech ERP username.

password string

The microtech ERP password.

redirectUri string

The redirect URI registered for the client (used for validation only).

scope string

The requested scope.

cancellationToken CancellationToken

Token to cancel the login.

Returns

Task<GraphQlTokenSet>

Exceptions

GraphQlAuthenticationException

Thrown when the credentials are rejected, the authorization server returns an error, or the code exchange fails.

RefreshAsync(string, CancellationToken)

Obtains a new token set using a refresh token.

public Task<GraphQlTokenSet> RefreshAsync(string refreshToken, CancellationToken cancellationToken = default)

Parameters

refreshToken string

The refresh token.

cancellationToken CancellationToken

Token to cancel the request.

Returns

Task<GraphQlTokenSet>

Exceptions

GraphQlAuthenticationException

Thrown when the token endpoint rejects the request (e.g. the refresh token expired or was revoked).

RevokeAsync(string, bool, CancellationToken)

Revokes a token at the /revoke endpoint (RFC 7009). The server always answers 200, even for unknown or already-invalid tokens. Revoking a refresh token also invalidates all tokens derived from it unless graceful is set.

public Task RevokeAsync(string token, bool graceful = false, CancellationToken cancellationToken = default)

Parameters

token string

The access or refresh token to revoke.

graceful bool

microtech extension: when true, only this token expires and derived tokens stay valid (e.g. to log out one device without affecting others).

cancellationToken CancellationToken

Token to cancel the request.

Returns

Task

Exceptions

GraphQlAuthenticationException

Thrown when the revoke endpoint rejects the request.