This question has been asked over and over again, but I have not yet found a satisfying answer:

How to use Social Logins (via OAuth2) to obtain access tokens for your backend if your only clients are native mobile apps.

I've stumbled upon the following approaches:

  1. Use a WebView and its messaging components to connect to your backend and do the Authorization Code Flow. However, the use of WebView seems to be discouraged [2].
  2. Doing PKCE directly from the native app and then manually passing the tokens to the server to access the resources. This feels somehow weird to me, as I don't really want and need the client to make requests to the third party. This should only happen through my backend.

Regarding the second point, is this even encouraged to do?

Why do I even want to use Social Logins in the first place? To delegate authentication to a third party. In my application, I would only utilize the third party to gather information such as email address and name to build a simple user profile.

The flow would look like this:

  1. User chooses provider (e.g. Google, Microsoft, Apple).
  2. Request is approved.
  3. My backend (whom I trust) issues a request to fetch user profile information.
  4. I create and store a user profile in my backend that uses the same primary identity that the third party returned to me, to identify the user again in the future.
  5. Last, I create a simple session token and return it to the app for further identifications.

I wouldn't really feel safe if the native app does this flow and then just present the backend a request like this:

user_id_obtained_from_third_party: uuid
email: string
firstname: string

What are your experiences and recommendations for such a flow?

  • The trick with OAuth and similar "standards" is that there exists some standard which can be configured 100 different ways. Things only work if both sides configure it the same way. You will need to find a suitable library to handle the OAuth handshake, which means deciding on a tech stack. That being said, I'm having difficulty finding the problem to solve in your post. It appears you are asking for general feedback, which does not fit the Q&A style of this community. Commented May 20 at 14:10
  • The question would be: what is the best suitable way to authenticate your application with social login providers (like Google, Apple, etc.), when your only client of your backend is a native mobile application. In a SPA, you could simply redirect the user in the browser. On success, you could simply set a cookie server side, and you're basically done. Everything is handled in your backend (regarding OAuth). But how would you do the same with native mobile apps if WebViews are discouraged?
    – rsmidt
    Commented May 20 at 15:42
  • The page about WebView and OAuth from Google links to documents suggesting fixes or alternatives. What about those will not work? Commented May 20 at 15:48
  • Hm. And each OAuth provider could have their own preferences for how you interact with their service. This could be a complex topic. Commented May 20 at 15:49
  • doesn't the client get a signed token which contains the email etc? so you can check its valid
    – Ewan
    Commented May 20 at 19:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.