I have to build a Windows Service which requires OAuth2 authentication. The service is intended (like all services should be) to run unattended (no user need to be logged in in Windows). The problem is, there is some user interaction required to get the OAuth2 authentication.

The service uses a third party API (I have no control over it) to do some checks, and sends out an email if a check comes back negative. The API requires authentication through a website. The service will run on an "always on" server.

Once authentication is validated, I would have a refresh token to periodically refresh authentication. So no more user interaction should be required after the initial authentication.

I think the best solution is to create a winForm/WPF application which prompts the user to login to the website and installs and start the service. As said, once authenticated, the service can run unattended since authentication can be periodically refreshed (tokens are saved in an encrypted file). If for some reason authentication is lost, the service can send out an email requesting a user to login and re-authenticate.

I would imagine the following flow:

Is this an advisable solution, or is there something better? Have I forgotten/missed something?