Table of Contents

Namespace TypedRest.OAuth

HttpClient DelegatingHandler for OAuth 2.0 / OpenID Connect authentication.

Note

NuGet package: TypedRest.OAuth

TypedRest OAuth

Adds support for OAuth 2.0 / OpenID Connect authentication to HttpClient.

dotnet add package TypedRest.OAuth

This provides an HttpClient DelegatingHandler that transparently requests access tokens with a client secret and caches them until they expire. It can be used independently of the other TypedRest packages.

Call .AddOAuthHandler() after .AddTypedRest():

services.AddTypedRest<MyClient>(new Uri("https://example.com/api/"))
        .AddOAuthHandler(new Uri("https://identity.example.com/"), clientId: "my-client", clientSecret: "…");

or after .AddHttpClient() when you are not using the main TypedRest package:

services.AddHttpClient<MyService>()
        .AddOAuthHandler(options =>
        {
            options.Uri = new Uri("https://identity.example.com/");
            options.ClientId = "my-client";
            options.ClientSecret = "…";
        });

OAuthOptions carries the settings for that flow. The Action<OAuthOptions> overload registers them as named options under the HTTP client's name, so different clients in the same application can authenticate against different identity servers and the settings can also come from configuration. To keep the client secret out of your code, build the options from configuration instead:

services.AddTypedRest<MyClient>(new Uri("https://example.com/api/"))
        .AddOAuthHandler(_ => configuration.GetSection("OAuth").Get<OAuthOptions>()!);

OAuthHandler sits in the HttpClient pipeline and keeps authentication out of your calling code entirely. On the first request it looks up the token endpoint via OpenID Connect discovery, performs a client credentials flow and attaches the resulting token as a Bearer header. The token is then reused for subsequent requests until shortly before it expires, so the identity server is contacted only occasionally rather than per request. If a server rejects a token as invalid anyway, the request is retried once with a freshly requested one.

API

Classes

HttpClientBuilderExtensions

Provides extension methods for IHttpClientBuilder.

OAuthHandler

HTTP message delegating handler that transparently performs OAuth 2.0 authentication with a client secret. Performs OpenID Connect discovery to find the token endpoint.

OAuthOptions

Options for OAuth 2.0 / OpenID Connect authentication.

Edit this page