Lexoffice.login 〈2K 2024〉

# Exchange data = "grant_type": "authorization_code", "code": auth_code, "redirect_uri": self.redirect_uri, "client_id": self.client_id, "code_verifier": self.code_verifier resp = requests.post(self.TOKEN_URL, data=data) resp.raise_for_status() tokens = resp.json() return tokens # contains access_token, refresh_token, expires_in

Future work could explore automated refresh token handling and background token refresh in SPAs using Web Workers. The principles outlined here are transferable to any OAuth2‑protected financial API. [1] lexoffice API Documentation. Authentication . Retrieved from https://developers.lexoffice.io/docs/#authentication [2] IETF RFC 6749 – The OAuth 2.0 Authorization Framework. [3] IETF RFC 7636 – Proof Key for Code Exchange (PKCE). [4] OWASP. OAuth 2.0 Security Cheat Sheet . [5] lexoffice OpenID Configuration – https://login.lexoffice.io/.well-known/openid-configuration Appendix – Full Token Response Example lexoffice.login

import hashlib import secrets import requests from urllib.parse import urlencode, urlparse, parse_qs class LexofficeLogin: AUTH_URL = "https://login.lexoffice.io/connect/authorize" TOKEN_URL = "https://login.lexoffice.io/connect/token" Authentication

– The author declares no affiliation with lexoffice GmbH. This paper is for educational purposes. This paper provides a complete, actionable analysis of lexoffice.login suitable for a developer audience, a software architecture review, or a student project in API security. [4] OWASP

def handle_callback(self, callback_url): """Parse callback, verify state, exchange code for tokens.""" parsed = urlparse(callback_url) query = parse_qs(parsed.query) if "state" not in query or query["state"][0] != self.state: raise ValueError("Invalid state parameter – possible CSRF attack") if "code" not in query: raise ValueError("No authorization code received") auth_code = query["code"][0]

: Enable logging on the token exchange but redact code_verifier and refresh_token before persisting. 7. Comparison with Other Accounting APIs | Feature | lexoffice | DATEV | Xero | QuickBooks | |---------|-----------|-------|------|-------------| | OAuth2 | ✅ PKCE | ✅ PKCE | ✅ PKCE | ✅ PKCE | | Refresh token rotation | ✅ (recommended) | ❌ | ✅ | ✅ | | Sandbox environment | ✅ | ✅ | ✅ | ✅ | | Scope discovery via metadata | ✅ OIDC Discovery | ❌ | ✅ | ✅ |