Authorization Code Flow

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

var CLIENT_ID = app.Configuration["Identity:ClientId"];
var CLIENT_SECRET = app.Configuration["Identity:ClientSecret"];

app.MapGet("/", (HttpRequest request) => {
    var uriBuilder = new UriBuilder("https://id.dev.aritma.io/connect/authorize");
    var query = new QueryString()
        .Add("response_type", "code")
        .Add("client_id", CLIENT_ID)
        .Add("scope", "bankservice")
        .Add("redirect_uri", $"{request.Scheme}://{request.Host}/callback");
    uriBuilder.Query = query.ToUriComponent();
    return Results.Redirect(uriBuilder.ToString());
});

app.MapGet("/callback", async (HttpRequest request) =>
{
    var code = request.Query["code"];

    var tokenClient = new HttpClient() { BaseAddress = new Uri("https://id.dev.aritma.io") };
    var response = await tokenClient
      .PostAsync("/connect/token",
        new FormUrlEncodedContent(
            new Dictionary<string, string>
            {
                { "grant_type", "authorization_code"},
                { "client_id", CLIENT_ID},
                { "client_secret", CLIENT_SECRET},
                { "redirect_uri", $"{request.Scheme}://{request.Host}/callback"},
                { "code", code }
            }
        )
      );
    var tokenResponse = await response.Content.ReadFromJsonAsync<Dictionary<string, object>>();
    var accessToken = tokenResponse["access_token"].ToString();

    // Do your api call here, or store token in session for later api calls.
    // This is an example request that lists all companies the user can access:
    var apiClient = new HttpClient() { BaseAddress = new Uri("https://bankservicedemo.zdata.no") };
    apiClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
    var apiResponse = await apiClient.GetAsync("/api/v3/companies");
    var companyResponse = await apiResponse.Content.ReadAsStringAsync();
    return Results.Ok(companyResponse);
});

app.Run();