# Class Oauth2

java.lang.Object
com.codename1.io.Oauth2

@Deprecated public class Oauth2 extends java.lang.Object
Deprecated.
Use `OidcClient` for new code.

Legacy OAuth2 authentication helper. Deprecated as of Codename One 8.0; new code should use `OidcClient` instead, which:

- Drives sign-in via the system browser (`SystemBrowser`) instead of an in-app WebView. Modern identity providers (Google, Apple, Microsoft, Facebook) refuse to render their sign-in pages inside an embedded WebView and will block this class.
- Performs PKCE on every authorization-code flow (mandatory now on most providers).
- Parses the OpenID Connect discovery document so you do not have to hard-code the authorization / token endpoints.
- Verifies the `state` and `nonce` parameters returned by the server.

This class is preserved as-is for source compatibility but no new functionality will be added. See the Authentication and Identity chapter of the developer guide for a migration recipe.

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Class
  Description
  `static class`
  `Oauth2.RefreshTokenRequest`
  Deprecated.

- ## Field Summary

  Fields
  Modifier and Type
  Field
  Description
  `static final String`
  `TOKEN`
  Deprecated.

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `Oauth2(String oauth2URL, String clientId, String redirectURI)`
  Deprecated.
  Simple constructor
  `Oauth2(String oauth2URL, String clientId, String redirectURI, String scope)`
  Deprecated.
  Simple constructor
  `Oauth2(String oauth2URL, String clientId, String redirectURI, String scope, String tokenRequestURL, String clientSecret)`
  Deprecated.
  Simple constructor
  `Oauth2(String oauth2URL, String clientId, String redirectURI, String scope, String tokenRequestURL, String clientSecret, Hashtable additionalParams)`
  Deprecated.
  Simple constructor

- ## Method Summary

  Modifier and Type
  Method
  Description
  `String`
  `authenticate()`
  Deprecated.
  This method preforms the actual authentication, this method is a blocking method that will display the user the html authentication pages.
  `Component`
  `createAuthComponent(ActionListener al)`
  Deprecated.
  This method creates a component which can authenticate.
  `static Oauth2`
  `fetchSerializedOauth2Request()`
  Deprecated.
  `static String`
  `getExpires()`
  Deprecated.
  Returns the expiry for the token received via oauth
  `static boolean`
  `handleRedirect(ActionListener callback)`
  Deprecated.
  When using the `#setUseRedirectForWeb(boolean)` option you should call this method at the beginning of your app's `start()` method.
  `protected void`
  `handleRedirectURLParams(Map params)`
  Deprecated.
  Method that can be overridden by subclasses to intercept parameters extracted from the redirect URL when the login flow reaches the redirect URL.
  `protected void`
  `handleTokenRequestResponse(String t)`
  Deprecated.
  Processes token request responses that are formatted as HTTP query strings.
  `protected void`
  `handleTokenRequestResponse(Map map)`
  Deprecated.
  Processes token request responses that are formatted as a JSON object.
  `static boolean`
  `isBackToParent()`
  Deprecated.
  Enables going back to the parent form after login is completed
  `boolean`
  `isUseBrowserWindow()`
  Deprecated.
  Checks if this component will use an external web browser window for the login process.
  `boolean`
  `isUseRedirectForWeb()`
  Deprecated.
  Checks wither this Oauth component is configured to use a redirect for Oauth login when running on the web.
  `Oauth2.RefreshTokenRequest`
  `refreshToken(String refreshToken)`
  Deprecated.
  `static void`
  `setBackToParent(boolean aBackToParent)`
  Deprecated.
  Enables going back to the parent form after login is completed
  `void`
  `setUseBrowserWindow(boolean useBrowserWindow)`
  Deprecated.
  Set this OAuth2 object to use a `BrowserWindow` for the login process.
  `void`
  `setUseRedirectForWeb(boolean redirect)`
  Deprecated.
  Sets thisOAuth2 object to use a redirect for login instead of an iframe when running on the Web (via the Javascript port).
  `void`
  `showAuthentication(ActionListener<ActionEvent> al)`
  Deprecated.
  This method shows an authentication for login form

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Field Details

  - ### TOKEN

    public static final String TOKEN
    Deprecated.
    See Also:
      - Constant Field Values

- ## Constructor Details

  - ### Oauth2

    public Oauth2(String oauth2URL, String clientId, String redirectURI)
    Deprecated.

    Simple constructor

    ###### Parameters

    - `oauth2URL`: the authentication url of the service

    - `clientId`: the client id that would like to use the service

    - `redirectURI`: the redirect uri

  - ### Oauth2

    public Oauth2(String oauth2URL, String clientId, String redirectURI, String scope)
    Deprecated.

    Simple constructor

    ###### Parameters

    - `oauth2URL`: the authentication url of the service

    - `clientId`: the client id that would like to use the service

    - `redirectURI`: the redirect uri

    - `scope`: the authentication scope

  - ### Oauth2

    public Oauth2(String oauth2URL, String clientId, String redirectURI, String scope, String tokenRequestURL, String clientSecret)
    Deprecated.

    Simple constructor

    ###### Parameters

    - `oauth2URL`: the authentication url of the service

    - `clientId`: the client id that would like to use the service

    - `redirectURI`: the redirect uri

    - `scope`: the authentication scope

    - `clientSecret`: the client secret

  - ### Oauth2

    public Oauth2(String oauth2URL, String clientId, String redirectURI, String scope, String tokenRequestURL, String clientSecret, Hashtable additionalParams)
    Deprecated.

    Simple constructor

    ###### Parameters

    - `oauth2URL`: the authentication url of the service

    - `clientId`: the client id that would like to use the service

    - `redirectURI`: the redirect uri

    - `scope`: the authentication scope

    - `clientSecret`: the client secret

    - `additionalParams`: @param additionalParams hashtable of additional parameters to the authentication request

- ## Method Details

  - ### isBackToParent

    public static boolean isBackToParent()
    Deprecated.

    Enables going back to the parent form after login is completed

    ###### Returns

    the backToParent

  - ### setBackToParent

    public static void setBackToParent(boolean aBackToParent)
    Deprecated.

    Enables going back to the parent form after login is completed

    ###### Parameters

    - `aBackToParent`: the backToParent to set

  - ### fetchSerializedOauth2Request

    public static Oauth2 fetchSerializedOauth2Request()
    Deprecated.

  - ### getExpires

    public static String getExpires()
    Deprecated.

    Returns the expiry for the token received via oauth

    ###### Returns

    the expires argument for the token

  - ### handleRedirect

    public static boolean handleRedirect(ActionListener callback)
    Deprecated.

    When using the `#setUseRedirectForWeb(boolean)` option you should call this method at the beginning of your app's `start()` method. If the app was loaded as a result of redirecting from an Oauth login, then this method will handle the login and will call the callback method on complete.

    ###### Parameters

    - `callback`: @param callback a listener that will receive at its source either a token for the service or an exception in case of a failure

    ###### Returns

    Returns:

      True the redirect was handled. False if it was not handled. If this returns true, then you should just return from the start() method, and instead handle control flow in your callback.

      ###### Since

      7.0

      ###### See also

      - #setUseRedirectForWeb(boolean)

      - #isUseRedirectForWeb()

  - ### authenticate

    public String authenticate()
    Deprecated.

    This method preforms the actual authentication, this method is a blocking method that will display the user the html authentication pages.

    ###### Returns

    Returns:

      the method if passes authentication will return the access token or null if authentication failed.

      ###### Throws

      - `IOException`: @throws IOException the method will throw an IOException if something went wrong in the communication.

      ###### Deprecated

  - ### isUseBrowserWindow

    public boolean isUseBrowserWindow()
    Deprecated.

    Checks if this component will use an external web browser window for the login process.

    ###### Returns

    True if this component will use an external web browser window.

    ###### Since

    7.0

  - ### setUseBrowserWindow

    public void setUseBrowserWindow(boolean useBrowserWindow)
    Deprecated.

    Set this OAuth2 object to use a `BrowserWindow` for the login process. You can set the global default via the "oauth2.useBrowserWindow" display property with either a "true" or "false" value.

    When this property is set, the login prompt will be displayed in a separate Window containing a web browser on the desktop. Platforms that don't have windows (e.g. iOS/Android) will fall back to a separate Form with a webview).

    ###### Parameters

    - `useBrowserWindow`: True to use a browser window for the login process.

    ###### Since

    7.0

  - ### isUseRedirectForWeb

    public boolean isUseRedirectForWeb()
    Deprecated.

    Checks wither this Oauth component is configured to use a redirect for Oauth login when running on the web.

    ###### Returns

    True if this component will use a redirect for Oauth login.

    ###### Since

    7.0

    ###### See also

    - #setUseRedirectForWeb(boolean)

    - #handleRedirect(com.codename1.ui.events.ActionListener)

  - ### setUseRedirectForWeb

    public void setUseRedirectForWeb(boolean redirect)
    Deprecated.

    Sets thisOAuth2 object to use a redirect for login instead of an iframe when running on the Web (via the Javascript port). Some Oauth providers won't work inside an iframe.

    Using this option will cause the browser to navigate away from the app to go to the login page. The Oauth login will redirect back to the app after login is complete.

    Warning: If the user has unsaved changes in the app, navigating away from the app may cause them to lose their changes. You should provide a warning, or confirmation prompt for the user in such cases. The usual onbeforeunload handler is disabled when using this action so the user won't receive any warnings other than what you explicitly prompt.

    ###### Parameters

    - `redirect`: Set to true to use a redirect for Oauth login instead of an iframe when running on the web.

    ###### Since

    7.0

    ###### See also

    - #isUseRedirectForWeb()

    - #handleRedirect(com.codename1.ui.events.ActionListener)

  - ### createAuthComponent

    public Component createAuthComponent(ActionListener al)
    Deprecated.

    This method creates a component which can authenticate. You will receive either the authentication key or an Exception object within the ActionListener callback method.

    ###### Parameters

    - `al`: @param al a listener that will receive at its source either a token for the service or an exception in case of a failure

    ###### Returns

    Returns:
      a component that should be displayed to the user in order to perform the authentication

  - ### showAuthentication

    public void showAuthentication(ActionListener<ActionEvent> al)
    Deprecated.

    This method shows an authentication for login form

    ###### Parameters

    - `al`: @param al a listener that will receive at its source either a token for the service or an exception in case of a failure

  - ### handleTokenRequestResponse

    protected void handleTokenRequestResponse(Map map)
    Deprecated.

    Processes token request responses that are formatted as a JSON object. May be overridden by subclasses, but subclass implementations should call super.handleTokenRequestResponse() so that the default implementation can parse out the token, expires, and refreshToken fields.

    ###### Parameters

    - `map`: Parsed JSON object of response.

    ###### Since

    7.0

  - ### handleTokenRequestResponse

    protected void handleTokenRequestResponse(String t)
    Deprecated.

    Processes token request responses that are formatted as HTTP query strings. May be overridden by subclass, but subclass implementations should call super.handleTokenRequestResponse() so that the default implementation can parse out the token, expires, and refreshToken fields.

    ###### Parameters

    - `t`: The query string.

    ###### Since

    7.0

  - ### handleRedirectURLParams

    protected void handleRedirectURLParams(Map params)
    Deprecated.

    Method that can be overridden by subclasses to intercept parameters extracted from the redirect URL when the login flow reaches the redirect URL. This will give subclasses an opportunity to parse out special information that the OAuth2 service provides in the callback.

    ###### Parameters

    - `params`: Parsed query parameters passed to the redirect URL.

  - ### refreshToken

    public Oauth2.RefreshTokenRequest refreshToken(String refreshToken)
    Deprecated.