How to best authenticate with non-Google identities
summary
Announcement that the platform is deprecating WebView for authentication and a clear walkthrough of the OAuth2 authorization code flow for native apps using Chrome/Samsung custom tabs. Shows concrete setup with Ping Identity: registration, authorization and token endpoints, redirect URIs and an example client ID (no hardcoded secrets). Implements AppAuth with an Auth0 JWT decoder to extract email/name/picture, OkHttp/Picasso for API and images, and uses AppAuth’s performActionWithFreshTokens to refresh tokens and handle logout via end session redirect.
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 1:43Authentication challenges explained
- 2:48OAuth 2 authorization code flow
- 4:55Setting up third-party identity provider
- 7:22AppAuth library implementation
- 10:29Android manifest configuration
- 11:52Authorization service setup
- 12:55Launching authorization request
- 14:40Handling authorization response
- 15:43Exchanging code for tokens
- 17:06Processing tokens and user data
- 18:08Making API calls with tokens
- 19:10Logging out and cleanup
related talks
36mOAuth Done Right: Secure Authentication for Androi…
44mThe Art of Authentication for Web Apps
30mStandards-based authentication for JavaScript sites
38mThe Present and Future of Standardized Authentication Specifications You Can Experience on Android/Chrome
49mUnderstanding OAuth 2.0 & OIDC
21mNo browser, no password, no problem
45mOAuth and beyond: Modern auth not only for the web
22mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens