What’s the best auth option for a mobile app with backend APIs?

For most mobile apps that talk to backend APIs, the best default choice is OAuth 2.1 / OpenID Connect (OIDC) with PKCE.

Why this is usually best

• Secure for mobile: PKCE is designed for public clients like iOS/Android apps.
• Works with third-party identity providers: Google, Apple, Microsoft, Auth0, Cognito, etc.
• Good UX: supports SSO and system browser login.
• Standardized: avoids rolling your own auth flow.

Typical setup

• Mobile app: uses the Authorization Code Flow with PKCE
• Backend API: accepts access tokens (usually JWTs or opaque tokens)
• Refresh tokens: if used, keep them carefully secured on-device
• Identity: OIDC handles login, OAuth handles API access

Recommended pattern

1. User signs in via browser-based OAuth/OIDC flow
2. App receives an authorization code
3. App exchanges code for access token + refresh token
4. App sends access token in Authorization: Bearer ... to your backend API
5. Backend validates token on each request

Storage guidance

• Store tokens in Keychain on iOS and Keystore/Encrypted SharedPreferences on Android
• Avoid putting long-lived secrets in the app binary
• Prefer short-lived access tokens

When to choose something else

• If it’s a simple first-party app with only your own backend: session cookies can work, but mobile cookie auth is often less clean than token auth.
• If you need super-simple internal auth: an API key is easy, but not ideal for user auth.
• If it’s machine-to-machine: use client credentials, not user login.

Bottom line

If you’re building a normal mobile app with backend APIs, use:

OIDC + Authorization Code Flow + PKCE + short-lived access tokens

If you want, I can also recommend a setup based on your stack, like Firebase, Auth0, Cognito, Supabase, or custom backend.