Nedo.AspNet.Authentication.TokenManagement 2.0.9

Nedo.AspNet.Authentication.TokenManagement

Access-token forwarding + proactive refresh + client-credentials acquisition for service-to-service calls. Pair with HttpClientFactory so your downstream calls automatically pick up the right token without per-call boilerplate.

Install

dotnet add package Nedo.AspNet.Authentication.TokenManagement

What it does

• ITokenManager — central token surface. Returns a fresh access token for a named client, refreshing transparently when the cached one is within the ProactiveRefreshThreshold.
• ITokenStore — pluggable persistence (default: in-memory; swap for IDistributedCache / Redis / EF for multi-instance hosts).
• AddTokenForwarding(clientName) — HttpClient integration. Adds the Authorization: Bearer … header on every outbound request to the named downstream API, refreshing as needed.

Quickstart — forward the caller's token to a downstream API

using Nedo.AspNet.Authentication.TokenManagement;

builder.Services.AddTokenManagement();

builder.Services
    .AddHttpClient("downstream-api", c => c.BaseAddress = new("https://api.internal/"))
    .AddTokenForwarding();   // injects Authorization header from the current request

// In a handler:
public class OrdersService(IHttpClientFactory factory)
{
    public Task<HttpResponseMessage> GetAsync()
        => factory.CreateClient("downstream-api").GetAsync("/orders");
    // ↳ outbound request carries the caller's bearer token automatically
}

Quickstart — client-credentials for unattended jobs

builder.Services.AddTokenManagement(opts =>
{
    opts.AddClient("background-worker", c =>
    {
        c.Authority    = "https://idp.example.com";
        c.ClientId     = "worker";
        c.ClientSecret = builder.Configuration["Worker:Secret"];
        c.Scope        = "api.read api.write";
    });
});

// In a job:
public class NightlyReport(ITokenManager tokens, IHttpClientFactory factory)
{
    public async Task RunAsync(CancellationToken ct)
    {
        var token = await tokens.GetAccessTokenAsync("background-worker", ct);
        var client = factory.CreateClient("downstream-api");
        client.DefaultRequestHeaders.Authorization = new("Bearer", token);
        // …
    }
}

Why use this

• Proactive refresh — tokens within ProactiveRefreshThreshold of expiry are refreshed before the next outbound call, avoiding the "401 → refresh → retry" round-trip on every request.
• Single source of truth — one cache shared across HttpClient instances; no race-condition refresh storms.
• No per-handler boilerplate — the AddTokenForwarding() extension wires the DelegatingHandler so domain code stays clean.

Docs

docs/06-token-management.md — full guide including ITokenStore swapping, multi-instance considerations, scope handling.

Related

License

MIT — see LICENSE.