Class OnBehalfOfTokenResponse

Namespace

Auth0.AuthenticationApi.Models

Assembly

Auth0.AuthenticationApi.dll

Represents the response of an On-Behalf-Of token exchange.

public class OnBehalfOfTokenResponse : TokenBase

Inheritance

object

TokenBase

OnBehalfOfTokenResponse

Inherited Members

TokenBase.AccessToken

TokenBase.TokenType

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

OptionalExtensions.AddIfNotNull<T>(T?, Dictionary<string, object?>, string)

Remarks

On-Behalf-Of exchange issues an access token only - no refresh or ID token.

Properties

ExpiresIn

Expiration time in seconds.

[JsonPropertyName("expires_in")]
public int ExpiresIn { get; set; }

Property Value

int

IssuedTokenType

The type of the token issued, as a URN.

[JsonPropertyName("issued_token_type")]
public string IssuedTokenType { get; set; }

Property Value

string

Scope

The scopes that were actually granted for this token, which may be narrower than the scope that was requested.

[JsonPropertyName("scope")]
public string Scope { get; set; }

Property Value

string

Methods

GetCurrentActor()

Returns the current actor - the outermost act.sub, identifying the client that performed the exchange. This is the only value to use for authorization decisions. Returns null when the token has no act claim or cannot be decoded.

public string? GetCurrentActor()

Returns

string

Remarks

The access token is decoded without signature verification. Validate the token separately before trusting this value.

GetDelegationChain()

Returns the full delegation chain (the current actor plus any nested prior actors). For audit/logging only - nested prior actors must not be used for access control. Returns null when the token has no act claim or cannot be decoded.

public Actor? GetDelegationChain()

Returns

Actor

Remarks

The access token is decoded without signature verification. Validate the token separately before trusting these values.