AppAuth for Android is a client SDK for communicating with OAuth 2.0 and OpenID Connect providers.
The library solves the problem of securely implementing OAuth 2.0 and OpenID Connect flows on Android by directly mapping the requests and responses of those specifications while following Android idioms. It implements best practices from RFC 8252 for native apps, including mandatory use of Custom Tabs for authorization requests instead of WebView, which the library explicitly does not support due to usability and security concerns. The library also supports the PKCE extension for securing authorization codes in public clients and is designed to handle additional parameters in protocol requests and responses, making it friendly to other standard or custom extensions.
Developers should choose this library if they are building Android applications that need to authenticate users through OAuth 2.0 or OpenID Connect providers. It works with any Authorization Server that supports native apps as documented in RFC 8252, using either custom URI scheme redirects or App Links. The library requires Android API 16 and above, though Custom Tabs are preferred when available. It is not suitable for Authorization Servers that assume all clients are web-based or require clients to maintain confidentiality of client secrets. The core design encapsulates authorization state in an AuthState class that can be persisted as JSON using any storage mechanism, and provides an AuthorizationService class for server communication, along with convenience methods for common tasks like obtaining fresh tokens.
The project maintains a demo application within the repository to illustrate usage patterns. Development activity shows consistent engagement with the specification standards that underpin the library's design.
