token-management

From README

Token Management When to Use This Skill Use this skill when: Building a .NET worker service or daemon that calls APIs using the client credentials flow Building an ASP.NET Core web application that calls APIs on behalf of the currently logged-in user Integrating Duende.AccessTokenManagement or Duende.AccessTokenManagement.OpenIdConnect with IHttpClientFactory Configuring token caching — in-memory, distributed (Redis), or hybrid — for machine-to-machine tokens Adding DPoP (Demonstrating Proof-of-Possession) key binding to access tokens Implementing API-to-API delegation where a downstream service calls further APIs with either user tokens or client credentials Revoking refresh tokens on user sign-out Core Principles Prefer Automatic Over Manual — Use IHttpClientFactory-integrated clients; they acquire, cache, refresh, and attach tokens transparently. Call GetAccessTokenAsync manually only when the factory pattern is insufficient. Never Cache Tokens in Code — The library owns the cache.