---
title: "sdk/windows"
description: "C# / .NET SDK for WinUI 3 applications using WebView2 for authorization, PKCE S256, and DPAPI-protected IsolatedStorage for token persistence."
locale: "en"
---

> Documentation Index
> Fetch the relevant documentation index at: https://vonvon.id/sdks/llms.txt
> Use this file to discover all available pages before exploring further.

# sdk/windows

## Status

Package status is **Implemented and verified locally**. The cross-platform .NET unit-test suite passes. WebView2, DPAPI, WinUI 3, and a real IdP round-trip still require a Windows integration environment. This page documents implemented behavior; it is not a production-readiness claim.

Registry status: UNPUBLISHED. Install this SDK only from the repository source checkout; do not use an external package registry.

## Requirements

- .NET 8 and Windows App SDK 1.6+
- WebView2 Runtime (Evergreen — pre-installed with Microsoft Edge)
- Application must set <UseWinUI>true</UseWinUI> in the project file

## Installation

Add a ProjectReference to the source checkout from your application project file:

```xml
<ItemGroup>
  <ProjectReference Include="../vonvon/sdk/windows/Vonvon.Windows.csproj" />
</ItemGroup>
```

## Quick start

```csharp
using Vonvon.Windows;

// 1. Configure in App.xaml.cs OnLaunched.
VonvonClient.Shared.Configure(new VonvonConfiguration
{
Issuer      = new Uri("https://vonvon.id"),
ClientId    = "your_client_id",
RedirectUri = "com.example.myapp://auth/callback",
// Scopes default: openid profile email. offline_access is rejected until DPoP is implemented.
});

// 2. Sign in (opens embedded WebView2 window)
VonvonSession session = await VonvonClient.Shared.SignInAsync();
Console.WriteLine($"Signed in: {session.User.Email}");

// 3. Get the current unexpired access token. Expiry requires reauthorization.
string? token = await VonvonClient.Shared.GetAccessToken();

// 4. Get the current unexpired session.
VonvonSession? current = await VonvonClient.Shared.GetSession();

// 5. Clear local state.
await VonvonClient.Shared.SignOut();
```

## Custom URI scheme callback (optional)

If using a custom URI scheme redirect rather than the WebView2 embedded window, forward the protocol activation URI to `HandleRedirectAsync`:

```csharp
// App.xaml.cs
protected override void OnActivated(IActivatedEventArgs args)
{
if (args.Kind == ActivationKind.Protocol)
{
    var protocolArgs = (ProtocolActivatedEventArgs)args;
    await VonvonClient.Shared.HandleRedirectAsync(protocolArgs.Uri);
}
}
```

## Core API

| Method | Description |
| --- | --- |
| `Configure(VonvonConfiguration)` | Initialize SDK. Call once at application startup. |
| `SignInAsync(options?, ct)` | Open an embedded WebView2 authorization window with PKCE S256. Returns VonvonSession on completion. |
| `HandleRedirectAsync(Uri, ct)` | Process a custom URI scheme callback and exchange the authorization code. |
| `GetSession(ct)` | Return the current unexpired session, clearing expired local state and returning null. |
| `GetAccessToken(options?, ct)` | Return the current unexpired access token; ForceRefresh clears the session and requires reauthorization. |
| `SignOut(ct)` | Clear local session tokens from DPAPI-protected IsolatedStorage. |
| `SetTokenStorage(ITokenStorage)` | Replace the default DpapiTokenStorage with a custom ITokenStorage implementation. |

## Storage adapter

The default storage encrypts tokens with DPAPI (CurrentUser scope) and persists them in IsolatedStorage. Implement `ITokenStorage` to use Windows Hello or Credential Manager:

```csharp
public sealed class MyCustomStorage : ITokenStorage
{
public Task SaveAsync(StoredTokenSet tokens, CancellationToken ct = default) { ... }
public Task<StoredTokenSet?> LoadAsync(CancellationToken ct = default) { ... }
public Task ClearAsync(CancellationToken ct = default) { ... }
}
VonvonClient.Shared.SetTokenStorage(new MyCustomStorage());
```

## Dependencies

| Package | Version | Purpose |
| --- | --- | --- |
| `Microsoft.WindowsAppSDK` | 1.6.250228002 | WinUI 3 host and WebView2 embedding |
| `Microsoft.Web.WebView2` | 1.0.3065.39 | Chromium-based embedded authorization window |
| `System.Security.Cryptography.ProtectedData` | 8.0.0 | DPAPI token encryption at rest |

## Security

- Public client — no client secret stored or transmitted.
- PKCE S256 only. Server rejects plain challenge method.
- Tokens encrypted with DPAPI (CurrentUser scope) and stored in IsolatedStorage. Not accessible to other Windows user accounts.
- OAuth state generated per request; validated on redirect to prevent CSRF.

## Known limitations

- WebView2 Runtime must be present. WebAuthenticationBroker support as a fallback is planned but not yet implemented.
- JWKS-backed ID token verification and end\_session sign-out are implemented and locally tested. Real Windows WebView2, DPAPI, and IdP round-trip validation is still required before L4 support.
- DpapiTokenStorage does not run on non-Windows platforms. Use a different ITokenStorage implementation when cross-compiling.

Source: https://vonvon.id/sdks/windows/index.mdx