AcquireTokenSilentAsync using a cached token

This page is for MSAL 3.x. If you are interested in MSAL 2.x, please go to AcquireTokenSilentAsync using a cached token 2.x

Tokens are cached

Once MSAL.NET has acquired a user token to call a Web API, it caches it. Next time the application wants a token, it should first call AcquireTokenSilent, to verify if an acceptable token is in the cache, can be refreshed, or can get derived. If not, call the AcquireTokenForFlow method depending on the flow you are interested in.

There are two flows before which you should not call AcquireTokenSilent:

• AcquireTokenForClient (Client credentials flow), which does not use the user token cache, but an application token cache. This method takes care of verifying this application token cache before sending a request to the STS
• AcquireTokenByAuthorizationCode in Web Apps, as it redeems a code that the application got by signing-in the user, and having them consent for more scopes. Since a code is passed as a parameter, and not an account, the method cannot look in the cache before redeeming the code, which requires, anyway, a call to the service.

AcquireTokenXYZ don't get token from the cache

Contrary to what happens in ADAL.NET, the design of MSAL.NET is such that AcquireTokenInteractive never looks at the cache. As an application developer, you need to call AcquireTokenSilent first. AcquireTokenSilent is capable, in many cases, of silently getting another token with more scopes, based on a token in the cache. It's also capable of refreshing a token when it's getting close to expiration (as the token cache also contains a refresh token)

Recommended call pattern in public client applications

The recommended call pattern is to first try to call AcquireTokenSilent, and if it fails with a MsalUiRequiredException, call AcquireTokenXYZ

Recommended call pattern in public client applications with MSAL.NET 3.x

AuthenticationResult result = null;
var accounts = await app.GetAccountsAsync();

try
{
 result = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault())
        .ExecuteAsync();
}
catch (MsalUiRequiredException ex)
{
 // A MsalUiRequiredException happened on AcquireTokenSilent.
 // This indicates you need to call AcquireTokenInteractive to acquire a token
 System.Diagnostics.Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");

 try
 {
    result = await app.AcquireTokenInteractive(scopes)
          .ExecuteAsync();
 }
 catch (MsalException msalex)
 {
    ResultText.Text = $"Error Acquiring Token:{System.Environment.NewLine}{msalex}";
 }
}
catch (Exception ex)
{
 ResultText.Text = $"Error Acquiring Token Silently:{System.Environment.NewLine}{ex}";
 return;
}

if (result != null)
{
 string accessToken = result.AccessToken;
 // Use the token
}

For the code in context, see the active-directory-dotnet-desktop-msgraph-v2 sample

Recommended call pattern in Web Apps using the Authorization Code flow to authenticate the user

For Web applications that use OpenID Connect Authorization Code flow, the recommended pattern in the Controllers is to:

• instantiate a ConfidentialClientApplication with a token cache for which you would have customized the serialization See token cache serialization for Web apps
• Call AcquireTokenByAuthorizationCode