Code in

Quickstart: mobile and desktop (PKCE)

Public clients: no secret, PKCE only, the system browser and an app scheme or claimed https link.

An app on somebody's phone or computer cannot keep a secret, so register it as a public app. It proves itself with PKCE alone, and it has no client secrets.

Rules for native apps

Use the system browser (ASWebAuthenticationSession on iOS, Custom Tabs on Android). Never an embedded web view: people cannot see the address bar, and we may refuse it.
Redirect to a claimed https link (Universal Links, App Links) or a private-use scheme in reverse-domain form, such as com.example.app:/auth. Register the exact address in the portal. Either needs its domain verified: com.example.app is on app.example.com, covered by verifying example.com.
Send code_challenge and code_challenge_method=S256 on every request, and the matching code_verifier when you swap the code.
At the token endpoint send client_id in the body and no secret.

AppAuth

AppAuth for iOS and Android follows these rules for you:

Ask for offline_access only if the app must keep working while the person is not using it. It gets you a refresh token, and the consent screen says so.

kotlin

val config = AuthorizationServiceConfiguration.fetchFromIssuer(Uri.parse("https://accounts.aton-network.org")) { config, _ ->
  val request = AuthorizationRequest.Builder(config!!, clientId, ResponseTypeValues.CODE, Uri.parse("com.example.app:/auth"))
    .setScopes("openid", "profile", "offline_access")
    .build() // AppAuth adds PKCE (S256) itself
  startActivityForResult(AuthorizationService(this).getAuthorizationRequestIntent(request), RC_AUTH)
}

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.