@egain/ai-agent-sdk API Reference - v0.3.2 / PKCEAuthStrategy
Class: PKCEAuthStrategy
PKCE (Proof Key for Code Exchange) authentication strategy for browsers Implements OAuth 2.0 PKCE flow for secure browser-based authentication using MSAL
Implements
Table of contents
Constructors
Methods
- resolveClientId
- buildConfigFromDeploymentInfo
- initialize
- authenticate
- isAuthenticated
- getToken
- startAuthorizationFlow
- handleCallback
- logout
- refreshToken
- cleanup
Constructors
constructor
• new PKCEAuthStrategy(config): PKCEAuthStrategy
Parameters
| Name | Type |
|---|---|
config | PKCEAuthConfig |
Returns
Defined in
core/auth/PKCEAuthStrategy.ts:362
Methods
resolveClientId
▸ resolveClientId(deploymentInfo, agentDetails, egClientId?): Object
Pick the MSAL client id for the PKCE flow. First non-empty source wins: egClientId (from initParams.egclientid) > agentDetails.clientAppId (admin console, Settings → Advanced) > deployment intClientId for agents / extClientId for customers > deployment clientId.
Parameters
| Name | Type | Description |
|---|---|---|
deploymentInfo | any | Deployment information carrying intClientId, extClientId, clientId |
agentDetails | any | Agent details carrying userType and optionally clientAppId |
egClientId? | string | Optional override from init params |
Returns
Object
The selected client id and which source supplied it (for logging)
| Name | Type |
|---|---|
clientId | string |
source | ClientIdSource |
Defined in
core/auth/PKCEAuthStrategy.ts:100
buildConfigFromDeploymentInfo
▸ buildConfigFromDeploymentInfo(deploymentInfo, agentDetails, endpoint, scopes, logger?, authScheme?, egClientId?, localLogin?): Promise<PKCEAuthConfig>
Build PKCE configuration from deployment info and agent details This method fetches authentication metadata and constructs the PKCE config
Parameters
| Name | Type | Description |
|---|---|---|
deploymentInfo | any | Deployment information containing API domain, client IDs, tenant ID |
agentDetails | any | Agent details containing userType and, when configured on the agent, clientAppId |
endpoint | string | The endpoint URL used to fetch deployment info (used for nextRoute) |
scopes | string[] | Scopes to request, already merged with the agent's extraScopes by AiAgent |
logger? | Logger | Optional logger instance for logging |
authScheme? | "popup" | "redirect" | Authentication scheme: 'popup' or 'redirect' (defaults to 'popup') |
egClientId? | string | Optional client ID override from initParams. Priority: egClientId > agentDetails.clientAppId > deployment intClientId (agent) / extClientId (customer) / clientId |
localLogin? | boolean | When true, forces local account login instead of federated SSO |
Returns
Promise<PKCEAuthConfig>
Promise resolving to PKCEAuthConfig
Defined in
core/auth/PKCEAuthStrategy.ts:133
initialize
▸ initialize(options?): Promise<void>
Initialize the PKCE authentication strategy
Parameters
| Name | Type |
|---|---|
options? | AuthStrategyInitializeOptions |
Returns
Promise<void>
Implementation of
Defined in
core/auth/PKCEAuthStrategy.ts:377
authenticate
▸ authenticate(): Promise<void>
Authenticate using PKCE flow
Returns
Promise<void>
Implementation of
Defined in
core/auth/PKCEAuthStrategy.ts:520
isAuthenticated
▸ isAuthenticated(): boolean
Check if the user is currently authenticated
Returns
boolean
Implementation of
Defined in
core/auth/PKCEAuthStrategy.ts:583
getToken
▸ getToken(): Promise<string>
Get authentication token using PKCE flow
Returns
Promise<string>
Implementation of
Defined in
core/auth/PKCEAuthStrategy.ts:590
startAuthorizationFlow
▸ startAuthorizationFlow(): Promise<void>
Start the PKCE authorization flow Redirects user to authorization server
Returns
Promise<void>
Defined in
core/auth/PKCEAuthStrategy.ts:662
handleCallback
▸ handleCallback(code, state): Promise<void>
Handle the OAuth callback with authorization code This is handled automatically by MSAL's handleRedirectPromise
Parameters
| Name | Type |
|---|---|
code | string |
state | string |
Returns
Promise<void>
Defined in
core/auth/PKCEAuthStrategy.ts:670
logout
▸ logout(): Promise<void>
Log out via MSAL using the same scheme as login. Popup omits state and uses redirectUri?logout=true. Redirect passes hash-stripped nextRoute as state so auth-redirect.html can bounce back. MSAL clears its own cache — do not call clearCache / removeAccount here. If MSAL throws, navigate to the JWT logout claim, else end_session_endpoint.
Returns
Promise<void>
Implementation of
Defined in
core/auth/PKCEAuthStrategy.ts:683
refreshToken
▸ refreshToken(): Promise<string>
Refresh the access token using refresh token
Returns
Promise<string>
Defined in
core/auth/PKCEAuthStrategy.ts:764
cleanup
▸ cleanup(): Promise<void>
Cleanup resources
Returns
Promise<void>