Mobile SDKs

The packages

The mobile SDK repository holds five packages. Every adapter uses the hosted authorization experience, the authorization code flow with PKCE S256, state validation, and the operating system's browser authentication surface.

Four rules the SDKs enforce

The flow in each SDK

val client = UnifyIDClient(
  UnifyIDConfig(
    clientId = "<your client id>",
    redirectUri = "https://app.example/oauth/callback",
    scopes = listOf("openid", "identity_verified"),
  )
)

val transaction = client.createTransaction()
client.authorize(activity, transaction)
// in onNewIntent:
val code = client.complete(callbackIntent, transaction)

let configuration = UnifyIDConfiguration(
  clientId: "<your client id>",
  redirectURI: URL(string: "https://app.example/oauth/callback")!,
  scopes: ["openid", "identity_verified"]
)

let client = UnifyIDClient(configuration: configuration)
let result = try await client.authorize(anchor: anchor)

The SDK generates PKCE, opens the system session and validates the callback. Then exchange the code with the original verifier — from the app as a public client, or from your backend.

{ "applinks": { "details": [
  { "appIDs": ["TEAMID.com.example.app"],
    "components": [{ "/": "/oauth/callback" }] }
]}}

Before you ship

• Test cancellation, a restart mid-flow, an offline return, an expired transaction and an unverified callback, and confirm none of them produces a session.
• Confirm the production callback domain is verified in the shipped build. A verification file that works in staging and not in production is a launch-day failure.
• Do not log authorization codes, access tokens or identity claims. Send crash diagnostics without personal identity information.
• Handle revoked consent explicitly: the next userinfo call answers 401, and the app needs somewhere to send the person.