Class LoginResponse
Response payload returned by the identity endpoint after a successful login or token refresh.
[ExcludeFromCodeCoverage]
public sealed class LoginResponse- Inheritance
-
LoginResponse
- Inherited Members
- Extension Methods
Remarks
Sensitive data. This payload contains bearer credentials. Treat the entire object as a secret: never log it, never include it in error messages, never serialize it to telemetry exporters without redaction. The serialized JSON form is what gets persisted in AccessTokenInfo; any place that handles that JSON must respect the same constraints.
Properties
AccessToken
The opaque access token to send in the Authorization header on subsequent requests.
[JsonPropertyName("accessToken")]
public required string AccessToken { get; set; }Property Value
Remarks
Treat as a secret. A leaked access token grants full session privileges until ExpiresIn elapses. Never log it, never include it in exception messages, never expose it through tracing, metrics, or browser-visible state. Redact it before it reaches any observability sink.
ExpiresIn
Number of seconds from issue time after which the access token expires.
[JsonPropertyName("expiresIn")]
public required int ExpiresIn { get; set; }Property Value
RefreshToken
The refresh token used to obtain a new access token without re-authenticating.
[JsonPropertyName("refreshToken")]
public required string RefreshToken { get; set; }Property Value
Remarks
Treat as a secret — strictly more sensitive than AccessToken. A leaked refresh token allows an attacker to mint fresh access tokens for the lifetime of the refresh-token policy (typically days to weeks). It must only be persisted in encrypted / platform-secure storage (e.g. the OS keychain or an HTTP-only cookie) and must never be logged, traced, returned to the browser, or sent to any non-identity endpoint.
TokenType
The bearer-token type (typically Bearer).
[JsonPropertyName("tokenType")]
public required string TokenType { get; set; }