I'm working on new authentication service for my company. We've got web app (asp.net) and separate API. API is consumed by third party integrators and also by our own mobile apps.

For mobile apps, many people use auto-signin available through Digital Asset Links and Google Smart Lock. For the user it means if he/she entered their password on our website and saved credentials, there is no need to enter them again on the mobile app.

Currently we use our custom authentication through API endpoint which apps are using. When app has got user's credentials, it sends them to the API endpoint and gets access/refresh tokens back, and user is logged immediately which is a good user experience.

All articles I read regarding mobile apps authentication recommend using Oauth2/OpenId Connect (authorization code or hybrid flow) but nowhere they mention the impact on UX - now users have to use the browser and enter credentials again for every new app they installed - the Digital Asset Links will no longer work. Also I have not seen much use of redirect-to-browser flows when using mobile apps.

If we still prefer to use OAuth2 / OpenID Connect only for our auth, is it possible to somehow use OAuth2 with Digital Asset Links and achieve the same level of user experience as with authentication through the API? Did anybody else had this problem with mobile apps and how it was solved?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.