Authentication and access
Supply current authority to the SDK without putting credentials in URLs, examples or browser storage.
Source 0.1.0 Private source package
Supply a current token
A direct integration supplies getAccessToken in its client options. Return the current approved token when requested. The SDK adds the bearer header; token acquisition, refresh, sign-out and consent remain with your identity integration.
Use only the identity flow approved for your integration. These source guides do not register an OAuth client or issue credentials. Do not reuse a first-party client, workforce identity, bridge token or device capability.
Retain account and layout scope
Keep each response tied to its account and layout. Clear retained authority and data when access ends or scope changes. A locally remembered selection does not prove that the current person may still read or operate it.
Keep secrets out of output
Do not put access tokens in query strings, shared code, screenshots, public issues or logs. Record bounded error kinds and correlation identifiers when needed. Keep raw server details and identity responses out of visitor-facing messages.