[OAUTH-WG] OAuth 2.0 for Native Apps: open source client libraries for Android and iOS now available

[William Denniss <[e-mail]>]

The Google Identity team this week open sourced AppAuth for Android and
iOS. AppAuth is a client library for OAuth that enables native Android and
iOS apps to perform authorization flows in a secure and usable way using
in-app browser tabs (Custom Tabs on Android, SFSafariViewController on
iOS), fully supporting the draft best practice
<https://tools.ietf.org/html/draft-ietf-oauth-native-apps> for performing
standards-based auth in native apps.

The libraries are opinionated and follow the draft best practice
completely. Low-level protocol APIs are exposed allowing customizability
including the ability to support OAuth extensions and custom parameters.
Higher level convenience APIs are also provided to assist with auth state
management, and encapsulate common requests like exchanging the
authorization code and making API calls with fresh tokens.

You can grab the code here:
https://openid.github.io/AppAuth-Android
https://openid.github.io/AppAuth-iOS

The library should work with any Authorization Server that supports public
clients with custom URI scheme and/or app-claimed HTTPS redirects (custom
URI schemes are still required for full backwards compatibility support,
though on newer systems app-claimed HTTPS links are viable – both are
supported by the library). We have verified interop with the Google and
PingFederate OAuth implementations.

Please give it a spin, and let me know how it works with your own
implementations!