Auth (legacy)

Note

This page covers the legacy email and password path. It is supported for integrations that already use it, and is not recommended for new work.

New integrations should use API-key authentication, which has no login call, no token to expire, and no refresh cycle.

STXLoginService

public class STXLoginService
{
    Task<STXUserDataCollection> LoginAsync(
        string email,
        string password,
        bool checkTermsAndConditions = false,
        bool keepSessionAlive = false,
        string deviceId = "C#SDK");
}

STXTokenService

public class STXTokenService
{
    Task<STXUserDataCollection> LoginAsync(
        string email,
        string password,
        bool keepSessionAlive,
        string deviceId = "C#SDK");

    Task<STXUserDataCollection> RefreshTokenAsync();

    STXTokens Tokens { get; }
}

STXUserDataCollection

Token	Bearer token attached to subsequent GraphQL calls
RefreshToken	Used by RefreshTokenAsync
UserId, UserUid, SessionId	Identifiers. UserId is what channel topics are keyed on
CurrentLoginAt	Login timestamp
PromptTncAcceptance	true if the current terms still need accepting
DeviceId, AllowMultipleLogins	Session context

The token is cached in STXUserStorage and attached automatically. You never pass it by hand.

Keeping the session alive

keepSessionAlive: true lets STXSessionBackgroundService refresh the token before it expires. It requires a real host, because background services only run under one:

var host = Host.CreateDefaultBuilder(args)
    .ConfigureServices(services => services.ConfigureSTXServices(STXEnvironment.OntarioDemo))
    .Build();

The credentials stay in memory in STXUserStorage so the background service can re-login if the refresh token itself expires. A failed refresh is reported through SetSessionMessageAction rather than thrown, so it cannot stop your host.

Two-factor authentication

Not available through this SDK. The SDK has no method for completing a 2FA challenge, so an account with 2FA enabled cannot finish logging in through it.

API keys are the supported path for programmatic access and are unaffected by 2FA.

Migrating

See Existing integrations for the steps. In short: swap the registration to the API-key overload, replace the user id from the login response with one GetMeAsync() call, and drop the keepSessionAlive handling.