Adding Callback URL For Token Validation In OAuth2.0 Authorization Code Flow #4632

babaktaremi · 2025-01-29T11:47:09Z

babaktaremi
Jan 29, 2025

I have installed the lastest Scalar.AspNetCore package. everything seems to be fine.
there are three issues in my opinion:

You have to set the client id , callback url , client secret every time you refresh the page. It would be nice to have the ability to configure these setttings in WithOAuth2Authentication method
unlike NSwag , there is no option to store bearer token . If you refresh the page the token is gone.
NSwag and Swashbuckle has /swagger/oauth2-redirect.html that you can set as callback url to retrieve token from IDP , currently if you use scalar with NSwag you can use this route for retrieving token and setting it will work just fine . But it would be better to have this feature built in for scalar

hanspagel · 2026-09-10T11:13:30Z

Thanks for the suggestions! Most of this is supported now 🙂

Use AddAuthorizationCodeFlow to preconfigure ClientId, ClientSecret, and RedirectUri. This replaces the older WithOAuth2Authentication API.
Enable EnablePersistentAuthentication() to keep authentication across page refreshes using browser local storage.
Scalar uses the documentation page itself as the default OAuth callback URL, so you can register that URL with your identity provider without NSwag. There is no dedicated oauth2-redirect.html endpoint currently.

Hope that helps!

0 replies