> ## Documentation Index
> Fetch the complete documentation index at: https://flexforms.bjanczak.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Write for Filament/Laravel developers buying Flex Forms.
> Be precise: every setting documents what it does and how it works.
> Use Help Center components richly: Steps, Cards, Callouts, Tabs, CodeGroup, Mermaid, Badge for Pro.
> Never invent APIs; match the real Flex Forms package behavior.

# Integration SDK helpers

> GraphQL, device-code OAuth, and SAML helpers for custom Flex Forms drivers — not shipped ACS/IdP or product SSO.

# Integration SDK helpers

These classes are **helpers for custom integration drivers** you register yourself. They are not a shipped ACS, IdP, or product SSO stack, and no first-party catalog driver uses them out of the box for device-code or SAML login.

Use them when you implement a driver that needs GraphQL HTTP, RFC 8628 device-code OAuth, or SAML assertion claim extraction for a Connection.

## GraphQL

```php theme={}
use Bjanczak\FilamentFlexForms\Integrations\Support\Http\GraphQlClient;

$client = new GraphQlClient('https://api.example.com/graphql');
$data = $client->dataOrFail(
    query: 'query ($id: ID!) { node(id: $id) { id } }',
    variables: ['id' => '1'],
    bearerToken: $accessToken,
);
```

Endpoint URLs are SSRF-hardened: **HTTPS public hosts only** (no private/link-local/metadata ranges). The helper uses the shared outbound HTTP client (timeouts, no open redirects).

## Device-code OAuth

No first-party driver ships device-code yet. The Studio **Authorize device** button appears only when your driver implements `SupportsDeviceCodeOAuth`.

```php theme={}
use Bjanczak\FilamentFlexForms\Integrations\Support\OAuth\DeviceCodeOAuthFlow;

$flow = new DeviceCodeOAuthFlow($driver);
$start = $flow->start('https://provider.example/device/code');
// Show $start['user_code'] + $start['verification_uri'] in Studio Connections
$token = $flow->poll($start['device_code']); // throws authorization_pending until approved
```

Device and token endpoint URLs follow the same SSRF rules (HTTPS public only). Authorization-code + PKCE remains the default via `GenericOAuthIntegrationDriver`.

## SAML assertion helper

`SamlAssertionConsumer` is for custom Connection auth in a driver — **not** Filament panel SSO. Keep host IdP login outside Flex Forms.

**Requirements:** you must pass the IdP signing certificate PEM. The consumer verifies XML digital signatures (XML-DSig) against that PEM, then checks Audience / Recipient (and related) claims.

```php theme={}
use Bjanczak\FilamentFlexForms\Integrations\Support\Saml\SamlAssertionConsumer;

$claims = (new SamlAssertionConsumer)->consume(
    $assertionXml,
    audiences: ['https://your-app.example'],
    recipient: 'https://your-app.example/acs',
    idpCertificatePem: $pem, // required — signature verified against this IdP PEM
);
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.