How do I implement OAuth login for a mobile app?

To implement OAuth login for a mobile app, the recommended approach is usually OAuth 2.0 + OpenID Connect (OIDC) using the Authorization Code flow with PKCE.

High-level flow

1. User taps “Sign in with X”
2. App opens the provider’s login page in the system browser
3. User authenticates and approves access
4. Provider redirects back to your app with an authorization code
5. Your app exchanges that code for tokens:
   • ID token (who the user is, if using OIDC)
   • Access token (API access)
   • optionally Refresh token
6. App stores tokens securely and uses them for authenticated API calls

Why use Authorization Code + PKCE

For mobile apps, avoid the old “implicit flow.”
Use PKCE because it protects the code exchange even if the authorization code is intercepted.

Typical implementation steps

1) Register your app with the provider

You’ll need:

• Client ID
• Redirect URI(s)
• Sometimes a bundle/package identifier or signing info

For mobile, the redirect URI is often:

• Custom scheme: myapp://callback
• Universal/App Link: https://myapp.example.com/oauth/callback

2) Start the authorization request

Build an authorization URL with:

• client_id
• redirect_uri
• response_type=code
• scope=openid profile email (for OIDC)
• code_challenge
• code_challenge_method=S256
• state for CSRF protection
• optionally nonce for ID token validation

Open it in:

• iOS: ASWebAuthenticationSession
• Android: Custom Tabs / browser-based auth

3) Receive the redirect

Your app listens for the redirect URI and extracts:

• code
• state

Verify state matches what you sent.

4) Exchange code for tokens

Send a POST request to the token endpoint with:

• grant_type=authorization_code
• code
• redirect_uri
• client_id
• code_verifier
  (and client secret only if your provider supports/needs it, but mobile apps generally should not embed secrets)

5) Store tokens securely

Use secure storage:

• iOS: Keychain
• Android: EncryptedSharedPreferences / Keystore-backed storage
• Cross-platform: secure storage plugin/wrapper

6) Use access token for API requests

Add:

• Authorization: Bearer <access_token>

7) Refresh when needed

If you get a refresh token, use it to obtain new access tokens when the old one expires.

---

Mobile-specific best practices

• Do not use embedded webviews for login unless the provider explicitly allows it
• Use the system browser / auth session
• Use PKCE
• Validate state
• If using OIDC, validate the ID token signature and claims
• Keep tokens in secure storage, not plain preferences/local storage
• Prefer short-lived access tokens and refresh rotation

---

Minimal example flow

Authorization request

GET https://provider.com/authorize?
  response_type=code&
  client_id=YOUR_CLIENT_ID&
  redirect_uri=myapp://callback&
  scope=openid%20profile%20email&
  state=RANDOM_STATE&
  code_challenge=CHALLENGE&
  code_challenge_method=S256

Token exchange

POST https://provider.com/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
client_id=YOUR_CLIENT_ID&
code=AUTH_CODE&
redirect_uri=myapp://callback&
code_verifier=YOUR_CODE_VERIFIER

---

Libraries that help

Depending on your stack:

• iOS / Swift: AppAuth-iOS, ASWebAuthenticationSession
• Android / Kotlin: AppAuth-Android, Custom Tabs
• React Native: react-native-app-auth
• Flutter: flutter_appauth or provider-specific packages
• Expo: expo-auth-session

---

Common mistakes to avoid

• Using a client secret in a mobile app
• Using implicit flow
• Storing tokens insecurely
• Not validating redirect state
• Using WebView instead of the system auth session
• Forgetting token refresh/expiration handling

If you want, I can also give you:

1. a platform-specific example for iOS, Android, React Native, or Flutter, or
2. a backend + mobile architecture for OAuth login.