MiddlewareOAuthConfig
Settings for requests sent to authorization server.
interface MiddlewareOAuthConfig {
clientId: string;
clientSecret: string;
cookieOptions?: MiddlewareCookieOptions;
pkceSupported?: boolean;
redirectUri?: string;
tokenEndpoint: string;
tokenRetryIntervalInSeconds?: false | number;
tokenRevokeEndpoint: string;
uri: string;
}Properties
| Name | Required | Type | Description |
|---|---|---|---|
clientId | Required | string | Client Id of OAuth Client. |
clientSecret | Required | string | Client Secret of OAuth Client. |
cookieOptions | Optional | MiddlewareCookieOptions | Object allowing to overwrite options of auth cookies (e.g. vsf-sap-token customer token cookie). |
pkceSupported | Optional | boolean | Optional override for the customer OAuth flow. When omitted, middleware auto-detects PKCE support during init. When true, CustomerTokenService uses Authorization Code + PKCE flow instead of ROPC for customer login. |
redirectUri | Optional | string | Optional redirect URI for the PKCE Authorization Code flow. Only required if the SAP Commerce instance requires a redirect_uri parameter. |
tokenEndpoint | Required | string | Endpoint for retrieving and refreshing customer/application tokens (e.g. /oauth/token). |
tokenRetryIntervalInSeconds | Optional | false | number | The number of seconds to wait before retrying to fetch an application token when the SAPCC authorization server is unavailable. Defaults to 30 seconds. Setting it to false disables the retry mechanism. |
tokenRevokeEndpoint | Required | string | Endpoint for revoking customers tokens (e.g. /oauth/revoke). |
uri | Required | string | Full OAuth server uri (e.g. https://<your-sap-api>/authorizationserver/). |