Build user consent into your client

Overview

The broker exposes begin/complete/status operations, but the client opens the browser and handles the callback. PKCE, nonce, single-use state and exact callbacks bind the result to the initiating flow. An administrator's permission to edit a profile is not the user's consent.

The external client owns the browser interaction

Begin returns information the client uses to open the provider's authorization page. The client handles the configured callback and completes the broker flow. PKCE, nonce and one-time state bind that response to the original initiation. The Cloud Server may help manage profiles or encrypted relays, but it is not the browser session in which the user grants consent.

State must belong to the initiating user

Store the pending flow with its intended owner and expiry. Handle cancellation and provider errors explicitly so the UI does not display Connected before completion succeeds. Reusing a callback from a different flow or account should fail. Tokens and authorization codes belong in protected flow handling, not ordinary agent messages, cloud logs or queryable work records.

Complete the user's consent flow

1. Call the connections client to begin authorization, navigate to the returned provider URL and retain the client-side flow context.
2. Complete the callback through the supported API with the exact registered URI. Validate state and user proof; never forward codes or tokens into agent prompts.
3. Display status, retry/cancel and disconnect. Handle reauthorization when a profile revision changes and reset local account-specific UI appropriately.

// http authenticates the current user to FabrCore, not to Graph or Google.
var connections = new FabrCoreConnectionsClient(http);
var transaction = await connections.BeginAsync(
    new("work", "https://my-client.example/connections/callback"));
// Client navigates the browser to transaction.AuthorizationUrl.
// Remember transaction.State and connection name in the client's session.

// On the registered callback, verify returned state against that client session.
await connections.CompleteAsync(new(
    "work", returnedState, returnedCode, returnedProviderError));

Go deeper

Explore the related documentation.

• FabrCore Microsoft Integrations
• FabrCore Connections
• FabrCore Microsoft 365 Copilot
• FabrCore A2A
• User consent in an external client