Develop Reference

Microsoft Graph API Security .net Core Client ID

I am following a tutorial from this URL
If you see the DeviceCodeAuthProvider and GetAccessToken, you would be able to get the token merely just by the app Id and the scope without any app/ client secret or password. You can also refresh the token just by providing the same info. My question is, is this safe? I thought the client id is just like a username.

Please refer the official docs. The DeviceCodeflow will provide the device code to validate the user/client id/app id and that is safe.
Device code flow protocol:

When invoking a messaging extension, can the conversation Id from Activity be matched with a chat Id from Graph API?

For context, please read this question, especially edit 3, along with the answer to edit 3.
I'm trying to get my Teams bot to get access to a list of participants in a private 1:1 conversation between two people (me and anyone else having a conversation with me), by invoking a messaging extension. Can this be done at all?
I'm using the latest Bot Builder SDK (4.6.3 at the time of writing)
A messaging extension query is handled by OnTeamsMessagingExtensionQueryAsync method, which provides ITurnContext<IInvokeActivity> object, which allows me to access the current conversation object using turnContext.Activity.Conversation property. This conversation object has an Id which looks like this:
a:15ya3x9GGFwBZUxa5Kd8DZzJ3IaWypTbCYjRhRL6bRYb0NmG4flXunysvJZWKdrJi3QVRrG7xZcjmZ9csxzyoK5cXuJb0hq29EpONRk6gLE7vprBPsA3jLTKymSTCdAqp
Let's assume I have authenticated with the bot and that I've consented to these API permissions:
Chat.ReadWrite
User.Read
User.ReadBasic.All
email
openid
profile
I have a valid access token which I've obtained by calling
await botAdapter.GetAadTokensAsync(
turnContext,
oauthConnectionName, // the connection name as configured in the bot channel registration
new string[] { "https://graph.microsoft.com" },
turnContext.Activity.From.Id, // the Teams Id of the action invoker, a.k.a me
cancellationToken);
Now when I call the Graph API endpoint, suggested by the linked answer, using the conversation Id above, I get an error 400 - bad request. With error description "Bad Request". Nothing more.
In this case, the call would look like this:
https://graph.microsoft.com/beta/chats/a:15ya3x9GGFwBZUxa5Kd8DZzJ3IaWypTbCYjRhRL6bRYb0NmG4flXunysvJZWKdrJi3QVRrG7xZcjmZ9csxzyoK5cXuJb0hq29EpONRk6gLE7vprBPsA3jLTKymSTCdAqp/members
The Graph Explorer confirms the same - code "BadRequest", message "Bad Request".
Now when I called https://graph.microsoft.com/beta/me/chats, I have noticed that chat IDs look nothing like above. After an investigation, I found that the actual ID of the target conversation, as communicated by the Graph API, was
19:62177c5c-7a61-44a5-9772-8d193a7f433f_71840467-a52d-4aaa-b15b-6fc89bd93a9b#unq.gbl.spaces
So when the following call would be invoked: https://graph.microsoft.com/beta/chats/19:62177c5c-7a61-44a5-9772-8d193a7f433f_71840467-a52d-4aaa-b15b-6fc89bd93a9b#unq.gbl.spaces/members, I was able to obtain a list of conversation members.
So what's the correlation between the ID given by turnContext.Activity.Conversation.Id and the actual Id expected by the Graph API? I'd like to note that, as observed in this example, it's obvious the expected ID already contains IDs of conversation members without the need to call this API, with the format <some-id>:<convo-member-id>_<my-id>#unq.gbl.spaces

Getting Yammer Access Token in C# Console application

I would like to post to my company Yammer feed from Console C# application.
Before, I created Javascript and Rest Application. But now, I do not know How to get access Token.
I tryed to use HttpWebRequest Class to Endpoint
https://www.yammer.com/dialog/oauth/?client_id=[my_client_id] &response_type=code&redirect_uri=[redirect_url]
However, Httpresponse Not contain "code".
Someone who know get access token, please tell me how to get access token.

There are a number of ways to get a sample token. You can now generate one within the screen where you created your client application. Go to https://www.yammer.com/client_applications/ and select the app you want to get a token for.
There is a link for 'Generate a developer token for this application'
For the API request you have listed I think the user would need to authenticate first then get a dialog box to accept\reject the app which would then redirect to get the code to exchange for an access token.
Docs are here:
https://developer.yammer.com/docs/oauth-2

Getting a refresh token from OAuth.io through REST API

I'm trying to get a refresh token for Google through Oauth.io but I'm having trouble finding the endpoint to send the code to. I'm using C# so I can't use the server-side SDK. I've also looked at Getting refresh tokens from Google with OAuth.io but that answer doesn't help me get the actual refresh token. I've looked at their server-side flow documentation which tells me I can get my refresh token at /auth/access_token but when looking at the web API documentation I don't see that endpoint listed.
I've also looked at their example here and I don't see the endpoint they use listed on the API documentation either. It also doesn't say which key/secret to use with that request - is it the one listed for my OAuth.io app, or is it the one for my provider (in this case Google)?
Any help going forward would be greatly appreciated.

I've just updated the documentation on docs.oauth.io, it was effectively /auth/access_token.
Take a look at the node.js SDK implementation: https://github.com/oauth-io/sdk-node/blob/master/coffee/lib/authentication.coffee#L99
The request is a POST on https://oauth.io/auth/access_token and require 3 parameters:
code : the code to be exchange against the access token / refresh token
key : the OAuth.io public key
secret : the OAuth.io secret key

PayPal NVP API: Creating Recurrent Payments

I am attempting to create a payment profiles using express checkout with an old NVP .NET (C#) API implementation. The version is 65.1.
After I perform a SetExpressCheckout, I get a successful response. The user is sent back to my test site, and I attempt to CreateRecurrentPaymentProfile. I pass in the url-decoded token, set the billing agreement description the same as the first step, and fire off the request. I always get an "The token is invalid" error. I've gone through and made sure I included all the required information from this page: https://developer.paypal.com/docs/classic/api/merchant/CreateRecurringPaymentsProfile_API_Operation_NVP/.
I also know that we are set up to allow for recurring payments because the recurring charges over direct payments currently works.
I know that everybody and their dog has had this issue when working with PayPal's NVP API at one point or another, but of the umpteen internet threads and discussions, none of them have helped. Any suggestions?

You should be using the same token returned in the response to your SetExpressCheckout. The token is good for 3 hours once it is returned so it isn't expired. Perhaps the token is corrupted somehow, with an extra character, or perhaps a character was omitted. The token should look similar to this: EC-5UG654898R029060W.
To reiterate: You get a valid token from the SetEC, you use this token in the redirect, you get this token back appended to the RETURNURL the customer returns to, and you reference this token in any subsequent GetEC and DoEC, CreateRP calls.