Manual Software Activation
def __init__(self, client_id, redirect_uri, scopes=None): self.client_id = client_id self.redirect_uri = redirect_uri self.scopes = scopes or ["openid", "profile", "invoice.read"] self.code_verifier = None self.state = None
lexoffice’s strength is strict PKCE enforcement and well‑structured OpenID Connect Discovery ( /.well-known/openid-configuration ). The lexoffice.login mechanism is a robust implementation of OAuth 2.0 + PKCE, suitable for both server‑side and public client applications. Developers must correctly generate the PKCE pair, validate the state parameter, and store tokens securely. By following the reference implementation and security recommendations in this paper, integration can achieve both usability and a high security level. lexoffice.login
def _generate_pkce_pair(self): """Generate code_verifier and code_challenge (S256).""" self.code_verifier = secrets.token_urlsafe(64)[:128] code_challenge = hashlib.sha256(self.code_verifier.encode()).digest() # Base64url encode without padding code_challenge = secrets.token_urlsafe(32) # simplified; use proper base64url # For correctness, implement: import base64 code_challenge = base64.urlsafe_b64encode( hashlib.sha256(self.code_verifier.encode()).digest() ).decode().rstrip("=") return code_challenge callback_url): """Parse callback
– lexoffice, OAuth 2.0, PKCE, API security, cloud accounting, single-page application (SPA), authentication flow. 1. Introduction lexoffice is a leading cloud accounting software for small and medium-sized enterprises (SMEs) in Germany. Its API (documented at https://developers.lexoffice.io ) enables automated invoice creation, contact management, and financial reporting. All API endpoints require authenticated access, governed by the lexoffice.login process. "scope": " ".join(self.scopes)
: Enable logging on the token exchange but redact code_verifier and refresh_token before persisting. 7. Comparison with Other Accounting APIs | Feature | lexoffice | DATEV | Xero | QuickBooks | |---------|-----------|-------|------|-------------| | OAuth2 | ✅ PKCE | ✅ PKCE | ✅ PKCE | ✅ PKCE | | Refresh token rotation | ✅ (recommended) | ❌ | ✅ | ✅ | | Sandbox environment | ✅ | ✅ | ✅ | ✅ | | Scope discovery via metadata | ✅ OIDC Discovery | ❌ | ✅ | ✅ |
def handle_callback(self, callback_url): """Parse callback, verify state, exchange code for tokens.""" parsed = urlparse(callback_url) query = parse_qs(parsed.query) if "state" not in query or query["state"][0] != self.state: raise ValueError("Invalid state parameter – possible CSRF attack") if "code" not in query: raise ValueError("No authorization code received") auth_code = query["code"][0]
def get_login_url(self): """Return the URL to redirect the user for lexoffice login.""" self.state = secrets.token_urlsafe(16) challenge = self._generate_pkce_pair() params = "response_type": "code", "client_id": self.client_id, "redirect_uri": self.redirect_uri, "scope": " ".join(self.scopes), "state": self.state, "code_challenge": challenge, "code_challenge_method": "S256" return f"self.AUTH_URL?urlencode(params)"