So I suppose this question isn't as much as a 'How to' but a 'which way' kind of question.

So I have a .net core api backend that makes calls to a dB

I also have a xamarin forms project that connects to the API and gets and posts all info.

However when it comes to authenticating and authorising. I am relying on jwt. As seen here:

public async Task<ActionResult> Login([FromBody] LoginViewModel model)
    var user = await _userManager.FindByNameAsync(model.UserName);
    if (user != null && await _userManager.CheckPasswordAsync(user, model.Password))
        var claim = new[] {
            new Claim(JwtRegisteredClaimNames.Sub, user.UserName)
        var signinKey = new SymmetricSecurityKey(

        int expiryInMinutes = Convert.ToInt32(_configuration["Jwt:ExpiryInMinutes"]);

        var token = new JwtSecurityToken(
          issuer: _configuration["Jwt:Site"],
          audience: _configuration["Jwt:Site"],
          expires: DateTime.UtcNow.AddMinutes(expiryInMinutes),
          signingCredentials: new SigningCredentials(signinKey, SecurityAlgorithms.HmacSha256)

        return Ok(
              token = new JwtSecurityTokenHandler().WriteToken(token),
              expiration = token.ValidTo
    return Unauthorized("did not log in");

So the xamarin connects to this endpoint, passes the username and details and returns a token upon succession.

Now thinking about all my other endpoints, i.e to send a message method in my API will be decorated with [Authorize] attribute and therefore will need the token gained from the previous login.

So should I store the token returned from the login method in the xamarin app? If so how would one do that within a xamarin.forms app? Are there any best practices to look at?

Also I will need access to the logged in users username and password, to pass into my API calls. Should I include this in my jwt payload? Or take this from the parameters passed into my login method? Any best practices for this?


  • What do you mean that you need the users password to pass into your API calls? After the initial login, the valid JWT itself should be sufficient to prove to the server who I am. No need for something as insecure as putting secret information in there. – Bart van Ingen Schenau Jun 1 '20 at 9:33
  • ahh brilliant, thank you! – dros Jun 1 '20 at 13:42

So should I store the token returned from the login method in the xamarin app? If so how would one do that within a xamarin.forms app?

Yes, you can just store it in memory. You also need a refresh token with a much longer expiry which you will want to store 'on disk' unless you want to user to login everytime they start the app, and bear in mind that "starting the app" can be a fuzzy thing on mobile.

you can use secure storage for this:


  • thanks a bundle, but can you go into a little more detailing about 'starting the app' being fuzzy? – dros Jun 1 '20 at 13:41
  • to save battery the OS controls whether the app is running or not, so changing app, or the lock screen sometimes 'closes' the app – Ewan Jun 1 '20 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.