Lexoffice.login

def __init__(self, client_id, redirect_uri, scopes=None): self.client_id = client_id self.redirect_uri = redirect_uri self.scopes = scopes or ["openid", "profile", "invoice.read"] self.code_verifier = None self.state = None

def get_login_url(self): """Return the URL to redirect the user for lexoffice login.""" self.state = secrets.token_urlsafe(16) challenge = self._generate_pkce_pair() params = "response_type": "code", "client_id": self.client_id, "redirect_uri": self.redirect_uri, "scope": " ".join(self.scopes), "state": self.state, "code_challenge": challenge, "code_challenge_method": "S256" return f"self.AUTH_URL?urlencode(params)" lexoffice.login

lexoffice’s strength is strict PKCE enforcement and well‑structured OpenID Connect Discovery ( /.well-known/openid-configuration ). The lexoffice.login mechanism is a robust implementation of OAuth 2.0 + PKCE, suitable for both server‑side and public client applications. Developers must correctly generate the PKCE pair, validate the state parameter, and store tokens securely. By following the reference implementation and security recommendations in this paper, integration can achieve both usability and a high security level. # Exchange data = "grant_type": "authorization_code"

– lexoffice, OAuth 2.0, PKCE, API security, cloud accounting, single-page application (SPA), authentication flow. 1. Introduction lexoffice is a leading cloud accounting software for small and medium-sized enterprises (SMEs) in Germany. Its API (documented at https://developers.lexoffice.io ) enables automated invoice creation, contact management, and financial reporting. All API endpoints require authenticated access, governed by the lexoffice.login process. governed by the lexoffice.login process.

# Exchange data = "grant_type": "authorization_code", "code": auth_code, "redirect_uri": self.redirect_uri, "client_id": self.client_id, "code_verifier": self.code_verifier resp = requests.post(self.TOKEN_URL, data=data) resp.raise_for_status() tokens = resp.json() return tokens # contains access_token, refresh_token, expires_in

import hashlib import secrets import requests from urllib.parse import urlencode, urlparse, parse_qs class LexofficeLogin: AUTH_URL = "https://login.lexoffice.io/connect/authorize" TOKEN_URL = "https://login.lexoffice.io/connect/token"