کوڈ

Quickstart: mobile and desktop (PKCE)

Public clients: no secret, PKCE only, the system browser and an app scheme or claimed https link.

مثالوں میں اپنی ٹیسٹ کلائنٹ آئی ڈی دیکھنے کے لیے سائن اِن کریں۔

An app on somebody's phone or computer cannot keep a secret, so register it as a public app. It proves itself with PKCE alone, and it has no client secrets.

Rules for native apps

Use the system browser (ASWebAuthenticationSession on iOS, Custom Tabs on Android). Never an embedded web view: people cannot see the address bar, and we may refuse it.
Redirect to a claimed https link (Universal Links, App Links) or a private-use scheme in reverse-domain form, such as com.example.app:/auth. Register the exact address in the portal. Either needs its domain verified: com.example.app is on app.example.com, covered by verifying example.com.
Send code_challenge and code_challenge_method=S256 on every request, and the matching code_verifier when you swap the code.
At the token endpoint send client_id in the body and no secret.

AppAuth

AppAuth for iOS and Android follows these rules for you:

Ask for offline_access only if the app must keep working while the person is not using it. It gets you a refresh token, and the consent screen says so.

kotlin

val config = AuthorizationServiceConfiguration.fetchFromIssuer(Uri.parse("https://accounts.aton-network.org")) { config, _ ->
  val request = AuthorizationRequest.Builder(config!!, clientId, ResponseTypeValues.CODE, Uri.parse("com.example.app:/auth"))
    .setScopes("openid", "profile", "offline_access")
    .build() // AppAuth adds PKCE (S256) itself
  startActivityForResult(AuthorizationService(this).getAuthorizationRequestIntent(request), RC_AUTH)
}

⁨Atlas⁩ سے پوچھیں

AI اسسٹنٹ

Atheron کے ساتھ سائن ان، API یا پورٹل کے بارے میں کچھ بھی پوچھیں۔ جواب ہماری دستاویزات سے آتا ہے، استعمال شدہ صفحات کے لنک کے ساتھ۔