The PKCE (Proof Key Code Exchange) flow is recommended for mobile and desktop applications that cannot securely store a ClientSecret.

To implement this:

1. Generate a random codeVerifier (a high-entropy cryptographic string).
2. Use XeroClient.BuildLoginUriPkce(codeVerifier) to generate the authorization URL to redirect the user.
3. After the user authorizes and is redirected back to your callback with a code, use XeroClient.RequestAccessTokenPkceAsync(code, codeVerifier) to exchange that code for a XeroToken set.

// 1. Setup configuration
XeroConfiguration xconfig = new XeroConfiguration();
xconfig.ClientId = "yourClientId";
xconfig.CallbackUri = new Uri("https://localhost:5001");
xconfig.Scope = "openid profile email offline_access files accounting.transactions accounting.contacts";
xconfig.State = "YOUR_STATE";

var client = new XeroClient(xconfig);

// 2. Generate a random codeVerifier
var validChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~";          
Random random = new Random();
int charsLength = random.Next(43, 128);
char[] randomChars = new char[charsLength];
for (int i = 0; i < charsLength; i++)  
{
    randomChars[i] = validChars[random.Next(0, validChars.Length)];
}
string codeVerifier = new String(randomChars);

// 3. Redirect user to login
return Redirect(client.BuildLoginUriPkce(codeVerifier));

// --- Later, in your callback controller ---

// 4. Exchange code for token
await client.RequestAccessTokenPkceAsync(code, codeVerifier);

Custom Connections are a premium Xero feature for Machine-to-Machine (M2M) integrations targeting a single organization. This uses the client_credentials grant, which bypasses the manual authorization step.

Important: Even though Custom Connections are valid for only one organization, you must still pass an empty string "" for the xeroTenantId parameter in API calls.

XeroConfiguration XeroConfig = new XeroConfiguration
{
    ClientId = System.Environment.GetEnvironmentVariable("CLIENT_ID"),
    ClientSecret = System.Environment.GetEnvironmentVariable("CLIENT_SECRET")
};

var client = new XeroClient(XeroConfig);
// Request token using client credentials grant
var xeroToken = await client.RequestClientCredentialsTokenAsync();

try {
    var apiInstance = new AccountingApi();
    var xeroTenantId = ""; // Must be an empty string for Custom Connections
    var result = await apiInstance.GetAccountsAsync(xeroToken.AccessToken, xeroTenantId, null, null, null);
    return result.ToJson();
}
catch (Exception e) {
    // Handle error
}

To manage App Store subscriptions, use the AppStoreApi. When a user purchases a plan, Xero redirects them to your URL with a subscriptionId query parameter.

To query subscription details:

1. Create a XeroClient using your App Store credentials.
2. Use RequestClientCredentialsTokenAsync(false) to get a token with the marketplace.billing scope.
3. Call AppStoreApi.GetSubscriptionAsync(accessToken, subscriptionId) to retrieve the plan details.

XeroConfiguration XeroConfig = new XeroConfiguration
{
    ClientId = System.Environment.GetEnvironmentVariable("APPSTORE_CLIENT_ID"),
    ClientSecret = System.Environment.GetEnvironmentVariable("APPSTORE_CLIENT_SECRET")
};

var client = new XeroClient(XeroConfig);
// Note: passing false to avoid fetching tenants if not needed
var xeroToken = await client.RequestClientCredentialsTokenAsync(false);

Guid subscriptionId = Guid.Parse("03bc74f2-1237-4477-b782-2dfb1a6d8b21");

try {
    var apiInstance = new AppStoreApi();
    var result = await apiInstance.GetSubscriptionAsync(xeroToken.AccessToken, subscriptionId);
    Console.WriteLine(result.ToJson());
}
catch (Exception e) {
    Console.WriteLine(e.Message);
}

To prevent CSRF attacks and ensure token integrity, follow these security best practices:

1. State Check: Compare the state returned in the OAuth flow with the state stored locally using TokenUtilities.GetCurrentState(). If they do not match, a CSRF attack may be in progress.
2. JWT Validation: After receiving the access token and ID token, validate the ID token using JwtUtils.validateIdToken (passing your ClientId) and validate the access token using JwtUtils.validateAccessToken.

// State check
var clientState = TokenUtilities.GetCurrentState();
if (state != clientState) {
  return Content("Cross site forgery attack detected!");
}

// Token validation
var client = new XeroClient(XeroConfig.Value);
var xeroToken = (XeroOAuth2Token)await client.RequestAccessTokenAsync(code);

if (!JwtUtils.validateIdToken(xeroToken.IdToken, XeroConfig.Value.ClientId)) {
  return Content("ID token is not valid");
}

if (!JwtUtils.validateAccessToken(xeroToken.IdToken)) {
  return Content("Access token is not valid");
}

The standard authentication flow involves two steps: redirecting the user to Xero to authorize your app, and then exchanging the returned code for an access token and tenant information.

// Step 1: Build the login link and redirect the user
public IActionResult Index()
{
    XeroConfiguration xconfig = new XeroConfiguration();
    xconfig.ClientId = "yourClientId";
    xconfig.ClientSecret = "yourClientSecret";
    xconfig.CallbackUri = new Uri("https://localhost:5001");
    xconfig.Scope = "openid profile email offline_access files accounting.transactions accounting.contacts";

    var client = new XeroClient(xconfig);
    return Redirect(client.BuildLoginUri());
}

// Step 2: In your callback URI, exchange the 'code' for tokens and tenants
public async Task<IActionResult> Callback(string code)
{
    XeroConfiguration xconfig = new XeroConfiguration(); 
    xconfig.ClientId = "yourClientId";
    xconfig.ClientSecret = "yourClientSecret";
    xconfig.CallbackUri = new Uri("https://localhost:5001");
    xconfig.Scope = "openid profile email files accounting.transactions accounting.contacts offline_access";
    
    var client = new XeroClient(xconfig);
    
    // Exchange the temporary code for a XeroToken
    await client.RequestAccessTokenAsync(code);
    
    // Retrieve the connected Xero Tenants
    List<Tenant> tenants = await client.GetConnections();
    
    foreach (Tenant tenant in tenants)
    {
        // Use tenant.TenantId and client.AccessToken to make API calls
    }
    return Ok();
}

After the user is redirected back to your CallbackUri, you will receive a code and a state parameter. Use RequestAccessTokenAsync to exchange the code for an access token, then call GetConnections() to retrieve the available Xero Tenant objects.

XeroConfiguration xeroConfig = new XeroConfiguration(); 
    xeroConfig.ClientId = "yourClientId";
    xeroConfig.ClientSecret = "yourClientSecret";
    xeroConfig.CallbackUri = new Uri("https://localhost:5001");
    xeroConfig.Scope = "openid profile email files accounting.transactions accounting.contacts offline_access";
    var client = new XeroClient(xeroConfig);

    // Exchange the code for an access token (ensure state matches your original request)
    await client.RequestAccessTokenAsync(code, "yourState");

    // Retrieve the Xero Tenants
    List<Tenant> tenants = await client.GetConnections();

    foreach (Tenant tenant in tenants)
    {
        // Access the token and tenant ID
        // string token = client.AccessToken;
        // string tenantId = tenant.TenantId;
    }