Authorization code

As explained in .NET MAUI in Action

An authorization code is a short-lived credential returned after user authorization that a client exchanges for access and related tokens.

An authorization code is a short-lived credential returned after successful user authorization. A client receives it through a redirect URI, then exchanges it for tokens. section 8.1.2

Returning a mobile login to the app

A .NET MAUI app uses the custom redirect URI auth.com.mildredsurf.stocktake://callback. After login, the identity provider returns the authorization code through that URI. WebAuthenticator receives the response, AuthBrowser extracts the code, and OidcClient processes it to return tokens to AuthService. section 8.1.2

Figure 8.4 When authenticating with an IDP, a redirect URL is supplied. Upon successful authentication, a response is sent back to the redirect URL. For a web application, this redirect is usually the address of the web application where the authentication request originated. For a mobile or desktop app, the URL uses a custom scheme that the OS associated with the app, so the response from the IDP is sent to the app.

Follow the redirect from the identity provider back to a registered mobile or desktop application. section 8.1.2

How .NET MAUI in Action covers it

How deep it goes

Explains its redirect, extraction, and token-exchange role, but defers the identity provider’s internal exchange process.

Examples

Demonstrates a custom-scheme callback, AuthBrowser parsing, and AuthService configuring OidcClient.

What it assumes

Assumes familiarity with OAuth2 browser login and teaches custom URL-scheme registration for application callbacks.

What you can do after

Operate/configure a mobile login callback that returns an authorization code for OidcClient token processing.

How it connects

Connects authorization code with OAuth2, OpenID Connect, redirect URI, WebAuthenticator, OidcClient, and tokens.

liveBookmanning.com

Read .NET MAUI in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Secure APIsAn authorization code is a short-lived credential issued by an authorization server that a client exchanges for an access token.

Compare how 2 books explain authorization code →

Related concepts

• authorization code flowused by · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• authorization serverproduced by · An authorization server is an OAuth component that authenticates clients or resource owners, obtains authorization, and issues credentials such as authorization codes and access tokens.
• authorization endpointproduced by · An authorization endpoint is an identity provider endpoint where a client initiates user authorization and authentication to obtain an authorization result.
• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.

This explainer was generated by Manning's knowledge graph from the text of .NET MAUI in Action. The section links point to the parts of the book it draws on.