Mobile Authentication: OAuth, PKCE & Refresh Rotation

Native apps are public clients — they can't keep a client secret. The standard (RFC 8252, OAuth 2.1) is authorization code flow with PKCE in the system browser (ASWebAuthenticationSession / Custom Tabs), never an embedded WebView. Issue short-lived access tokens (5–15 min) and rotating refresh tokens (each use returns a new one; reuse of an old one revokes the family). Store tokens in Keychain / Android Keystore-backed storage. For first-party apps with your own login UI, an equivalent design is a first-party session token endpoint — but keep the same rotation and storage rules.

Mobile login options

val request = AuthorizationRequest.Builder(serviceConfig, clientId, ResponseTypeValues.CODE, redirectUri)
    .setScopes("openid", "profile", "offline_access")
    .build()                                   // AppAuth generates PKCE verifier + S256 challenge
val intent = authService.getAuthorizationRequestIntent(request)   // Custom Tabs
launcher.launch(intent)

async def refresh(old_token: str) -> TokenPair:
    rec = await tokens.find(hash_token(old_token))
    if rec is None:
        raise Unauthorized()
    if rec.used_at is not None:                       # reuse detected → likely theft
        await tokens.revoke_family(rec.family_id)
        raise Unauthorized("refresh_token_reused")
    await tokens.mark_used(rec.id)
    return await issue_pair(rec.user_id, family_id=rec.family_id)   # new access + new refresh

Common pitfalls

• Client secrets embedded in the app.
• Long-lived access tokens with no rotation.
• Tokens in SharedPreferences/UserDefaults in plain text.

Key points

• Auth code + PKCE in the system browser
• Short access tokens, rotating refresh tokens
• Keychain/Keystore storage

Further reading: RFC 8252: OAuth 2.0 for Native Apps