Optional adapters for applications that already use Google.Apis.Auth. The package keeps the shared OfficeIMO Google Workspace kernel free of Google SDK dependencies, supports GoogleCredential and UserCredential, and provides an installed-application authorization entry point that always enables PKCE.
Interactive authorization requires an application-provided IGoogleWorkspaceTokenStore. The convenience GoogleInstalledApplicationAuthorization.AuthorizeAsync method always requires a GoogleWorkspaceCredentialBindingResolver, because it returns a credential source that can participate in guarded sessions. The resolver must check the acquired token against provider-issued account and scope evidence; caller-entered labels do not qualify. Read-only applications that do not need verified mutation identity can call AuthorizeCredentialAsync and construct a resolver-free GoogleApisCredentialSource from the returned UserCredential. OfficeIMO intentionally provides no plaintext refresh-token store by default.