PriceActionNinja
Join Pro

| Threat | Mitigation | |--------|-------------| | Interception of authorization code | PKCE ensures the code is bound to a verifier | | Code injection into callback | Redirect URI allowlist + state parameter | | Replay attacks | Nonce and short-lived tokens (1 hour) | | Token leakage in logs | Automatic redaction of sensitive parameters |

[1] lexoffice API Documentation. Authentication . Retrieved from https://developers.lexoffice.io/docs/#authentication [2] IETF RFC 6749 – The OAuth 2.0 Authorization Framework. [3] IETF RFC 7636 – Proof Key for Code Exchange (PKCE). [4] OWASP. OAuth 2.0 Security Cheat Sheet . [5] lexoffice OpenID Configuration – https://login.lexoffice.io/.well-known/openid-configuration

| Feature | lexoffice | DATEV | Xero | QuickBooks | |---------|-----------|-------|------|-------------| | OAuth2 | ✅ PKCE | ✅ PKCE | ✅ PKCE | ✅ PKCE | | Refresh token rotation | ✅ (recommended) | ❌ | ✅ | ✅ | | Sandbox environment | ✅ | ✅ | ✅ | ✅ | | Scope discovery via metadata | ✅ OIDC Discovery | ❌ | ✅ | ✅ |

Since your Lexoffice account contains sensitive financial and tax data, it is crucial to keep it secure: