I’ve created a service that will run in the background and receive callback events from Gmail on behalf of my users. Letting users authorize my application and the required scopes in ASP.NET Core is trivial. Creating a Google client and using it to configure everything is also easy.

But I can’t figure out how to combine those two actions.

Many examples for ASP.NET Core use something like this:

[Authorize(AuthenticationSchemes = GoogleOpenIdConnectDefaults.AuthenticationScheme)]
public async Task<IActionResult> Callback([FromServices] IGoogleAuthProvider auth)

But when I use that in combination with builder.AddAuthentication().AddGoogleOpenIdConnect(), it complains that the credentials are incorrect.

‘UnderlyingCredential is not an OIDC token provider. Only ServiceAccountCredential, ComputeCredential, ImpersonatedCredential are supported OIDC token providers.’

I’ve also seen that I can get a SecurityToken from the OnTokenValidated callback, but how can I use that token to connect using the Google client?

I also would like a token with a longer lifetime, as my app will aid with some aspects of my user’s email over a longer duration.