5.2.13. xgt.cached_oidc_auth

xgt.cached_oidc_auth(config: OidcClientConfig, force_login: bool = False, open_browser: bool = True) → BearerTokenAuth

Return a valid BearerTokenAuth, using the cache where possible.

Experimental: The API of this function may change in future releases.

Resolution order:

  1. Fresh cached access token: return immediately.

  2. Cached refresh token: attempt a silent refresh; on failure, run a new login flow.

  3. No usable cache: run a new login flow.

If the IdP does not rotate refresh tokens, the existing refresh token is preserved in the refreshed payload so subsequent calls can still refresh.

Parameters:

  • config (OidcClientConfig) – OIDC client configuration identifying the IdP and the token cache.

  • force_login (bool) – When True, ignore the cache and run a fresh login flow.

  • open_browser (bool) – When True, open the authorization URL in the default browser; set to False in headless environments, where the URL is printed instead.

Returns:

Authentication carrying a valid access token.

Return type:

BearerTokenAuth