All recommendations related to user authentication in mobile applications indicate that we should use oauth2 with pkce, in this case we have to use the custom tabs solution, but no browser redirection is used in any financial application (wise, stripe, paypal, revolut) authentication is done in the existing client application. Is password grant flow still recommended?

  • 1
    Mobile apps have the advantage that, via intents/sharing contracts, they can send the user to a first-party app (which is already authenticated, or where the user logs in) rather than needing to authorize access to that account within their own app. With that said, it's absolutely a bad idea to expect users to input their credentials for app/site X into your app/site Y; avoiding that scenario is one of the major reasons Authorization Code-type flows, and OAuth in general, exists.
    – CBHacking
    Feb 14 at 9:50

1 Answer 1


Is password grant flow still recommended?

No, the Resource Owner Password Credential flow is not recommended anymore:

The latest OAuth 2.0 Security Best Current Practice disallows the password grant entirely, and the grant is not defined in OAuth 2.1.

The best practice draft states:

The resource owner password credentials grant [RFC6749] MUST NOT be used. This grant type insecurely exposes the credentials of the resource owner to the client.

You should use the Authorization Code Grant with PKCE:

Specifically, features not specified in OAuth 2.0 core, such as PKCE, are required in OAuth 2.1. Additionally, some features available in OAuth 2.0, such as the Implicit or Resource Owner Credentials grant types, are not specified in OAuth 2.1.

The applications you are talking about appears (?) to be first-party applications. In this case, using OAuth2 might be overkill anyway:

"While the advice to not use OAuth seems out-of-place in this document, it is important to note that OAuth was originally created for third-party or federated access to APIs, so it may not be the best solution in a single common-domain deployment. That said, there are still some advantages in using OAuth even in a common-domain architecture: […]"

  • Than why these big players do not use external browser?
    – Bera
    Feb 16 at 4:43
  • Note that Chrome Custom Tabs (developer.chrome.com/docs/android/custom-tabs) are running inside the browser applications instance, not inside the containing application.This is an external browser.
    – ysdx
    Feb 16 at 8:33
  • See this video youtube.com/watch?v=DdQTXrk6YTk for the position of the Android team about SSO for Android applications and the recommendation to use Custom Tabs if available.
    – ysdx
    Feb 16 at 8:39
  • I got how it works. I ask why not amy big company application like paypal, facebook, venmo, revolut do not use custom tabs? If it is depricated already to use password grant
    – Bera
    Feb 16 at 13:05
  • Are you sure the apps you are talking about are actually using OAuth2? For first party applications, using OAuth2 might be quite overkill. See ietf.org/archive/id/… for a discussion on this.
    – ysdx
    Feb 16 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .