– The author declares no affiliation with lexoffice GmbH. This paper is for educational purposes. This paper provides a complete, actionable analysis of lexoffice.login suitable for a developer audience, a software architecture review, or a student project in API security.
– lexoffice, OAuth 2.0, PKCE, API security, cloud accounting, single-page application (SPA), authentication flow. 1. Introduction lexoffice is a leading cloud accounting software for small and medium-sized enterprises (SMEs) in Germany. Its API (documented at https://developers.lexoffice.io ) enables automated invoice creation, contact management, and financial reporting. All API endpoints require authenticated access, governed by the lexoffice.login process. lexoffice.login
def __init__(self, client_id, redirect_uri, scopes=None): self.client_id = client_id self.redirect_uri = redirect_uri self.scopes = scopes or ["openid", "profile", "invoice.read"] self.code_verifier = None self.state = None – The author declares no affiliation with lexoffice GmbH
def get_login_url(self): """Return the URL to redirect the user for lexoffice login.""" self.state = secrets.token_urlsafe(16) challenge = self._generate_pkce_pair() params = "response_type": "code", "client_id": self.client_id, "redirect_uri": self.redirect_uri, "scope": " ".join(self.scopes), "state": self.state, "code_challenge": challenge, "code_challenge_method": "S256" return f"self.AUTH_URL?urlencode(params)" – lexoffice, OAuth 2
def _generate_pkce_pair(self): """Generate code_verifier and code_challenge (S256).""" self.code_verifier = secrets.token_urlsafe(64)[:128] code_challenge = hashlib.sha256(self.code_verifier.encode()).digest() # Base64url encode without padding code_challenge = secrets.token_urlsafe(32) # simplified; use proper base64url # For correctness, implement: import base64 code_challenge = base64.urlsafe_b64encode( hashlib.sha256(self.code_verifier.encode()).digest() ).decode().rstrip("=") return code_challenge