Repository navigation
Add support for client assertion access token - #16
Merged
Merged
Conversation
matnun-br
requested review from
clement911 and
greg-betterreports
and
a balanced review from Copilot
November 2, 2026 03:45
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Request-level tests do not cover unsupported curves, unusable PEM keys, or invalid application-only token responses, leaving key validation paths untested.
2 open issues
What changed in this PR
Adds application-only authentication to ShopifyNet using signed ES256 client assertions, alongside the existing OAuth flows.
Changes:
- Adds fresh client assertion generation, token requests without a client secret, and response validation.
- Provides P-256 signing-key generation through a library helper and console tool.
- Adds signing/request tests, an opt-in integration test, and setup documentation.
| File | Description |
|---|---|
| ShopifyNet/OAuth/ShopifyOAuthClient.cs | Implements assertion-based token requests and disables default HTTP redirects. |
| ShopifyNet/OAuth/ShopifyClientAssertionAccessToken.cs | Defines the expiring token response with token-safe string output. |
| ShopifyNet/OAuth/ShopifyApplicationOnlyKeys.cs | Generates private PEM keys and public JWKs. |
| ShopifyNet.Tests/ShopifyClientAssertionIntegrationTests.cs | Adds an opt-in live token request test. |
| ShopifyNet.Tests/ShopifyClientAssertionAccessTokenRequestTests.cs | Verifies request fields, signatures, and fresh assertions. |
| ShopifyNet.Tests/ShopifyApplicationOnlyKeyPairTests.cs | Tests generated keys and key ID validation. |
| ShopifyNet.sln | Registers the key-generation console project. |
| ShopifyNet.KeyPairGenerator/ShopifyNet.KeyGenerator.csproj | Configures the console tool and library reference. |
| ShopifyNet.KeyPairGenerator/KeyPairGenerator.cs | Prints generated private keys and public JWKs. |
| README.md | Documents key generation, token acquisition, and integration testing. |
Review effort: Balanced
Base automatically changed from
feat/add-support-to-non-expiring-token
to
main
November 3, 2026 00:50
… client assertion access token
…lgorithms - Updated README with new key generation instructions. - Modified ShopifyOAuthClient to support RS256 alongside ES256. - Enhanced tests to cover both signing algorithms and key validation.
clement911
force-pushed
the
feat/add-support-for-client-accesstoken
branch
from
November 3, 2026 00:50
5ecc8ca to
1069ccd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.