# Microsoft.Identity.Client

**Kind:** Service

**Source:** `Pams/API/Pams.API.Core/Pams.API.Core.csproj` (line 1)

**Part of:** [Pams](subsystem-pams)

NuGet package dependency

`Microsoft.Identity.Client` is a NuGet package referenced by `Pams.API.Core.csproj` for Microsoft identity authentication flows. The API Core project uses it to acquire tokens and authenticate calls to Microsoft-protected resources.

## Diagram

```mermaid
sequenceDiagram
    participant Client as TypeScript Client
    participant API as Pams API Core
    participant MSAL as Microsoft.Identity.Client
    participant Identity as Microsoft Identity Platform

    Client->>API: Send authenticated request
    API->>MSAL: Acquire access token
    MSAL->>Identity: Request token
    Identity-->>MSAL: Return access token
    MSAL-->>API: Return access token
    API-->>Client: Return API response
```

## Usage

```typescript
async function getProtectedData(accessToken: string) {
  const response = await fetch("/api/protected-data", {
    headers: {
      Authorization: `Bearer ${accessToken}`,
    },
  });

  if (!response.ok) {
    throw new Error("Protected API request failed");
  }

  return response.json();
}
```

## AI Coding Instructions

- Keep `Microsoft.Identity.Client` configuration and token acquisition inside the .NET API layer; TypeScript clients should send bearer tokens to API endpoints.
- Read identity configuration values from application configuration or environment variables rather than hard-coding tenant, client, or secret values.
- Request access tokens only for the scopes required by the downstream Microsoft resource.
- Handle token acquisition failures without returning identity-provider error details to API clients.

## Used by

1 reference from 1 file. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

### Injected or called by (1)

- `Pams.API.Core` — `Pams/API/Pams.API.Core/Pams.API.Core.csproj`:1