Protocols and how-tos
OAuth and OpenID Connect for native and mobile apps
Why native apps must use the system browser rather than an embedded web view, which redirect URIs to use, and why PKCE is mandatory (RFC 8252).
The short answer
Native apps should sign users in through the system browser (or an in-app browser tab such as ASWebAuthenticationSession or Custom Tabs), using the authorization code flow with PKCE, and receive the code on a claimed HTTPS link, a private-use URI scheme or a loopback address. RFC 8252 forbids relying on embedded web views because the app can read everything the user types into them.
Sources last reviewed .
Why not an embedded web view
A web view is part of the app, so the app can inject script and read the password field. Users cannot verify the address bar, and they cannot use an existing provider session or password manager. RFC 8252 section 8.12 says native apps must not use embedded user agents for authorization requests.
Redirect URI options
- Claimed HTTPS scheme (Universal Links / App Links): the strongest, because the OS verifies the app owns the domain.
- Private-use URI scheme in reverse-domain form (com.example.app:/callback): workable, but another app can claim the same scheme — which is why PKCE is required.
- Loopback (http://127.0.0.1:{port}/) for desktop apps, with any port allowed at runtime.
Tokens on the device
Keep refresh tokens in the platform keystore (Keychain, Android Keystore). Native apps are public clients — a secret compiled into the binary is not a secret — so rely on PKCE, refresh token rotation or DPoP rather than an embedded client secret.
In Authreads
How this applies to Authreads
Authreads public OpenID Connect clients require PKCE, and loopback redirect URIs on 127.0.0.1 or [::1] may use plain HTTP with any runtime port, consistent with RFC 8252.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.