I'm now trying to implement user authentication on my android app. I, however, have a few questions.

I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I should encrypt the user's password before it's sent from the phone to the server.

Parts of my app return JSON data (from my API) that are specifically made for that user (based on their identification). After authentication, how can I request data based on the user's identification?

I have heard others mention something about a token (OAuth?). Would this token be saved both on the phone and within my server's database? Would the token then be included in each API request and verified with the server database before returning any data?

Is there anything else I should know? Links to tutorials? Security?

Thank you!

  • 3
    To encrypt password you can just use TLS. Commented Sep 28, 2015 at 0:25
  • 1
    Did you google android app authentication? There seems to be lots of useful info there. Commented Sep 28, 2015 at 16:03

2 Answers 2


You can take a look at JSON web token.

SSL is required!

The user submit his username and password the first time.

After verification you just send a token to the phone which will be used to verify the user and the permission on each request.

Details are available on http://jwt.io/.


Before you start rolling out your own authentication and identity management platform, you may want to consider alternate services (e.g. stormpath, IBM service mix, jan rain - no affiliation with any of them) to see whether they can help you reduce the work needed and ensure that you implement these features securely.

If you still think you want to rollout your own authentication infrastructure, I would suggest that 1. Use SSL/TLS - this is bare minimum requirement to ensure that any client/server communication is encrypted. 2. Store Salted and hashed Passwords - ensure that password are adequately secured on server side. 3. Basic Auth - You can use Basic Authentication mechanism to pass the user id/password to server.

Please refer and read OWASP guidance (more specifically Authentication Cheat Sheet ) for more details about what you should consider.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .