Concepts

Core Concepts

Core Concepts

Credential Management

What It Is

GPAL provides one consistent way to retrieve credentials regardless of where they live. Three families cover every case: direct values you supply inline, password manager vaults that look up saved logins by name or URL, and provider authentication that handles OAuth flows and API keys for cloud services and AI providers. Every family shares the same fluent interface and ends with the same two terminal calls -- one that builds a login row for a form, and one that returns a bearer token for an API call. The code that consumes the result never needs to know which source produced it.

How It Works

Vault lookups work one of two ways: through an installed command-line tool that must already be logged in, or through a REST API with a key pair. Either way, you search by name, URL, or username and get back one login row per match. Provider authentication is different. Service accounts authenticate directly; OAuth flows open a browser once for consent. Save the refresh token and supply it on later runs to skip that step. Both paths end with a bearer token ready for an API call.

// Build a reusable master login once, as CredentialServiceType.None

var masterLogin = GPAL.CredentialsFor(CredentialServiceType.None)

.WithUsername("you@example.com")

.WithPassword("master-password")

.ToGPALObject();


// Vault lookup: reuse the master login, terminate with SaveTo

var loginGrid = GPAL.Grid.ToGPALObject();

GPAL.CredentialsFor(CredentialServiceType.LastPass)

.WithCredentials(masterLogin)

.GetCredentialsFor("example.com")

.WithDomain("example.com")

.SaveTo(loginGrid);


GPAL.Browser

.GoTo("https://example.com/login")

.WithSelector("#username")

.WithSelector("#password")

.FillInFrom(loginGrid)

.LeftClick("#login");


// OAuth/service-account: terminate with FetchAccessToken instead

GPAL.CredentialsFor(CredentialServiceType.Google)

.WithUsername("you@example.com")

.WithPassword("your-password")

.WithClientId("client-id.apps.googleusercontent.com")

.WithClientSecret("client-secret")

.WithRefreshToken("refresh-token") // skips the consent browser on repeat runs

.WithScope(OAuthScope.Google_Drive)

.FetchAccessToken(out string accessToken);


GPAL.RESTClient

.WithAPIBase("https://www.googleapis.com")

.WithEndpoint("/drive/v3/about?fields=user")

.WithHeader("Authorization", "Bearer " + accessToken)

.Execute();

Key Details

A config file backs the credential system with OAuth endpoints, redirect URIs, and vault API base URLs for each provider. Load() reads it and Save() writes it back. Both accept an optional filename -- passing one sets the shared default path so the other follows automatically. OAuth flows open a browser once for consent; save the refresh token and supply it on later runs to skip that step. Static API keys bypass OAuth entirely -- they go in directly and FetchAccessToken hands them back as-is.

WARNING

If a vault's command-line tool isn't installed or logged in, GPAL publishes an error event with the login command to run, and the lookup returns no rows -- leaving nothing to fill into a form. GPAL also doesn't check that a credential type matches its consuming provider. A mismatched key and provider will compile and run but fail with an authentication error at request time. Verify login status and key/provider pairing before relying on either in an unattended workflow.

On this page

Core Concepts
Credential Management
  • What It Is
  • How It Works
  • Key Details
    • 💬 Ask GPAL