Flutter AppAuth

https://pub.dev/packages/flutter_appauth
Admin
Flutter AppAuth is a plugin that provides a bridge to the native AppAuth SDKs for authenticating and...
Tokens:5,681
Snippets:61
Trust Score:9.9
Update:3 months ago
Show doc for...
Tokens:
Raw
### Manifest Placeholder Error Example

Source: https://pub.dev/packages/flutter_appauth

Example of the error message encountered when incorrectly using = instead of += for manifestPlaceholders.

```text
Attribute application@name at AndroidManifest.xml:5:9-42 requires a placeholder substitution but no value for <applicationName> is provided.

```

--------------------------------

### Initialize and use FlutterAppAuth in a Flutter application

Source: https://pub.dev/packages/flutter_appauth/example

This example demonstrates setting up the FlutterAppAuth plugin and implementing various sign-in flows including code exchange and ephemeral sessions.

```dart
import 'dart:convert';
import 'dart:io' show Platform;
import 'dart:math';

import 'package:flutter/material.dart';
import 'package:flutter/services.dart';
import 'package:flutter_appauth/flutter_appauth.dart';
import 'package:http/http.dart' as http;

void main() => runApp(const MyApp());

class MyApp extends StatefulWidget {
  const MyApp({super.key});

  @override
  State<MyApp> createState() => _MyAppState();
}

class _MyAppState extends State<MyApp> {
  bool _isBusy = false;
  final FlutterAppAuth _appAuth = const FlutterAppAuth();

  String? _codeVerifier;
  String? _nonce;
  String? _authorizationCode;
  String? _refreshToken;
  String? _accessToken;
  String? _idToken;
  String? _error;

  final TextEditingController _authorizationCodeTextController =
      TextEditingController();
  final TextEditingController _accessTokenTextController =
      TextEditingController();
  final TextEditingController _accessTokenExpirationTextController =
      TextEditingController();

  final TextEditingController _idTokenTextController = TextEditingController();
  final TextEditingController _refreshTokenTextController =
      TextEditingController();
  String? _userInfo;

  // For a list of client IDs, go to https://demo.duendesoftware.com
  final String _clientId = 'interactive.public';
  final String _redirectUrl = 'com.duendesoftware.demo:/oauthredirect';
  final String _issuer = 'https://demo.duendesoftware.com';
  final String _discoveryUrl =
      'https://demo.duendesoftware.com/.well-known/openid-configuration';
  final String _postLogoutRedirectUrl = 'com.duendesoftware.demo:/';
  final List<String> _scopes = <String>[
    'openid',
    'profile',
    'email',
    'offline_access',
    'api'
  ];

  final AuthorizationServiceConfiguration _serviceConfiguration =
      const AuthorizationServiceConfiguration(
    authorizationEndpoint: 'https://demo.duendesoftware.com/connect/authorize',
    tokenEndpoint: 'https://demo.duendesoftware.com/connect/token',
    endSessionEndpoint: 'https://demo.duendesoftware.com/connect/endsession',
  );

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      home: Scaffold(
        appBar: AppBar(
          title: const Text('Plugin example app'),
        ),
        body: SafeArea(
          child: SingleChildScrollView(
            child: Column(
              children: <Widget>[
                Visibility(
                  visible: _isBusy,
                  child: const LinearProgressIndicator(),
                ),
                const SizedBox(height: 8),
                ElevatedButton(
                  child: const Text('Sign in with no code exchange'),
                  onPressed: () => _signInWithNoCodeExchange(),
                ),
                const SizedBox(height: 8),
                ElevatedButton(
                  child: const Text(
                      'Sign in with no code exchange and generated nonce'),
                  onPressed: () => _signInWithNoCodeExchangeAndGeneratedNonce(),
                ),
                const SizedBox(height: 8),
                ElevatedButton(
                  onPressed: _authorizationCode != null ? _exchangeCode : null,
                  child: const Text('Exchange code'),
                ),
                const SizedBox(height: 8),
                ElevatedButton(
                  child: const Text('Sign in with auto code exchange'),
                  onPressed: () => _signInWithAutoCodeExchange(),
                ),
                if (Platform.isIOS || Platform.isMacOS)
                  Padding(
                    padding: const EdgeInsets.all(8.0),
                    child: ElevatedButton(
                      child: const Text(
                        'Sign in with auto code exchange using ephemeral '
                        'session',
                        textAlign: TextAlign.center,
                      ),
                      onPressed: () => _signInWithAutoCodeExchange(
                          externalUserAgent: ExternalUserAgent
                              .ephemeralAsWebAuthenticationSession),
                    ),
                  ),
                if (Platform.isIOS)
                  Padding(
                    padding: const EdgeInsets.all(8.0),
                    child: ElevatedButton(
                      child: const Text(
                        'Sign in with auto code exchange using '
                        'SFSafariViewController',
                        textAlign: TextAlign.center,
                      ),
```

--------------------------------

### Perform Authenticated API Request

Source: https://pub.dev/packages/flutter_appauth/example

Executes an HTTP GET request using the stored access token in the Authorization header.

```dart
Future<void> _testApi(TokenResponse? response) async {
    final http.Response httpResponse = await http.get(
        Uri.parse('https://demo.duendesoftware.com/api/test'),
        headers: <String, String>{'Authorization': 'Bearer $_accessToken'});
    setState(() {
      _userInfo = httpResponse.statusCode == 200 ? httpResponse.body : '';
      _isBusy = false;
    });
  }
```

--------------------------------

### Initialize Flutter AppAuth

Source: https://pub.dev/packages/flutter_appauth

Create an instance of the FlutterAppAuth plugin to begin authentication operations.

```dart
FlutterAppAuth appAuth = FlutterAppAuth();

```

--------------------------------

### Configure Info.plist for Custom URL Schemes

Source: https://pub.dev/packages/flutter_appauth

Add this configuration to your Info.plist file to register a custom URL scheme for OAuth redirects. Replace <your_custom_scheme> with your specific scheme value.

```xml
<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleTypeRole</key>
        <string>Editor</string>
        <key>CFBundleURLSchemes</key>
        <array>
            <string><your_custom_scheme></string>
        </array>
    </dict>
</array>
```

--------------------------------

### Configure Redirect Scheme in build.gradle

Source: https://pub.dev/packages/flutter_appauth

Use this configuration in your Groovy DSL build file. Ensure the use of += to avoid overwriting existing manifest placeholders.

```gradle

android {
    ...
    defaultConfig {
        ...
        manifestPlaceholders += [
                'appAuthRedirectScheme': '<your_custom_scheme>'
        ]
    }
}

```

--------------------------------

### Configure Redirect Scheme in build.gradle.kts

Source: https://pub.dev/packages/flutter_appauth

Use this configuration in your Kotlin DSL build file to define the redirect scheme.

```gradle

android {
    ...
    defaultConfig {
        ...
        manifestPlaceholders.putAll(
            mapOf(
                "appAuthRedirectScheme" to "<your_custom_scheme>"
            )
        )
    }
}

```

--------------------------------

### Add dependency via command line

Source: https://pub.dev/packages/flutter_appauth/install

Use this command in your terminal to automatically add the latest version of the package to your project.

```bash
$ flutter pub add flutter_appauth
```

--------------------------------

### Import the package

Source: https://pub.dev/packages/flutter_appauth/install

Include this import statement at the top of your Dart files to access the library functionality.

```dart
import 'package:flutter_appauth/flutter_appauth.dart';
```

--------------------------------

### Add dependency via command line

Source: https://pub.dev/packages/flutter_appauth_platform_interface/install

Use this command in your terminal to add the package to your Flutter project.

```bash
 $ flutter pub add flutter_appauth_platform_interface
```

--------------------------------

### Authorize and Exchange Code via Discovery

Source: https://pub.dev/packages/flutter_appauth

Perform an authorization request and exchange the code using an OpenID Connect discovery URL.

```dart
final AuthorizationTokenResponse result = await appAuth.authorizeAndExchangeCode(
                    AuthorizationTokenRequest(
                      '<client_id>',
                      '<redirect_url>',
                      discoveryUrl: '<discovery_url>',
                      scopes: ['openid','profile', 'email', 'offline_access', 'api'],
                    ),
                  );

```

--------------------------------

### Import the package

Source: https://pub.dev/packages/flutter_appauth_platform_interface/install

Include this import statement in your Dart files to access the package functionality.

```dart
import 'package:flutter_appauth_platform_interface/flutter_appauth_platform_interface.dart';
```

--------------------------------

### Authorize and Exchange Code with Explicit Configuration

Source: https://pub.dev/packages/flutter_appauth

Perform an authorization request and exchange the code by explicitly defining the service endpoints.

```dart
final AuthorizationTokenResponse result = await appAuth.authorizeAndExchangeCode(
                    AuthorizationTokenRequest(
                      '<client_id>',
                      '<redirect_url>',
                      serviceConfiguration: AuthorizationServiceConfiguration(authorizationEndpoint: '<authorization_endpoint>',  tokenEndpoint: '<token_endpoint>', endSessionEndpoint: '<end_session_endpoint>'),
                      scopes: [...]
                    ),
                  );

```

--------------------------------

### Configure Redirect URI in AndroidManifest.xml

Source: https://pub.dev/packages/flutter_appauth

Manually add an intent-filter for RedirectUriReceiverActivity to handle authorization callbacks.

```xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.example.my_app">
...
<activity
        android:name="net.openid.appauth.RedirectUriReceiverActivity"
        android:theme="@style/Theme.AppCompat.Translucent.NoTitleBar"
        android:exported="true"
        tools:node="replace">
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="<your_custom_scheme>"
              android:host="<your_custom_host>"/>
    </intent-filter>
</activity>
...


```

--------------------------------

### Process Authentication and Token Responses

Source: https://pub.dev/packages/flutter_appauth/example

Updates the application state with tokens and metadata from authorization and token exchange responses.

```dart
void _processAuthTokenResponse(AuthorizationTokenResponse response) {
    setState(() {
      _accessToken = _accessTokenTextController.text = response.accessToken!;
      _idToken = _idTokenTextController.text = response.idToken!;
      _refreshToken = _refreshTokenTextController.text = response.refreshToken!;
      _accessTokenExpirationTextController.text =
          response.accessTokenExpirationDateTime!.toIso8601String();
    });
  }
```

```dart
void _processAuthResponse(AuthorizationResponse response) {
    setState(() {
      /*
        Save the code verifier and nonce as it must be used when exchanging the
        token.
      */
      _codeVerifier = response.codeVerifier;
      _nonce = response.nonce;
      _authorizationCode =
          _authorizationCodeTextController.text = response.authorizationCode!;
      _isBusy = false;
    });
  }
```

```dart
void _processTokenResponse(TokenResponse response) {
    setState(() {
      _accessToken = _accessTokenTextController.text = response.accessToken!;
      _idToken = _idTokenTextController.text = response.idToken!;
      _refreshToken = _refreshTokenTextController.text = response.refreshToken!;
      _accessTokenExpirationTextController.text =
          response.accessTokenExpirationDateTime!.toIso8601String();
    });
  }
```

--------------------------------

### Authorize and Exchange Code Automatically

Source: https://pub.dev/packages/flutter_appauth/example

Executes the full authorization and token exchange flow in one call, with options for custom service configurations and prompt parameters.

```dart
Future<void> _signInWithAutoCodeExchange(
      {ExternalUserAgent externalUserAgent =
          ExternalUserAgent.asWebAuthenticationSession}) async {
    try {
      _setBusyState();

      /*
        This shows that we can also explicitly specify the endpoints rather than
        getting from the details from the discovery document.
      */
      final AuthorizationTokenResponse result =
          await _appAuth.authorizeAndExchangeCode(
        AuthorizationTokenRequest(_clientId, _redirectUrl,
            serviceConfiguration: _serviceConfiguration,
            scopes: _scopes,
            externalUserAgent: externalUserAgent),
      );

      /* 
        This code block demonstrates passing in values for the prompt
        parameter. In this case it prompts the user login even if they have
        already signed in. the list of supported values depends on the
        identity provider

        ```dart
        final AuthorizationTokenResponse result = await _appAuth
        .authorizeAndExchangeCode(
          AuthorizationTokenRequest(_clientId, _redirectUrl,
              serviceConfiguration: _serviceConfiguration,
              scopes: _scopes,
              promptValues: ['login']),
        );
        ```
      */

      _processAuthTokenResponse(result);
      await _testApi(result);
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### Add dependency to pubspec.yaml

Source: https://pub.dev/packages/flutter_appauth_platform_interface/install

Manually add this line to your pubspec.yaml file to include the package as a dependency.

```yaml
dependencies:
  flutter_appauth_platform_interface: ^12.0.1
```

--------------------------------

### Exchange Authorization Code for Token

Source: https://pub.dev/packages/flutter_appauth

Manually exchange an authorization code for a token using stored nonce and code verifier values.

```dart
final TokenResponse result = await appAuth.token(TokenRequest('<client_id>', '<redirect_url>',
        authorizationCode: '<authorization_code>',
        discoveryUrl: '<discovery_url>',
        codeVerifier: '<code_verifier>',
        nonce: 'nonce',
        scopes: ['openid','profile', 'email', 'offline_access', 'api']));

```

--------------------------------

### Add dependency to pubspec.yaml

Source: https://pub.dev/packages/flutter_appauth/install

Manually add this line to the dependencies section of your pubspec.yaml file.

```yaml
dependencies:
  flutter_appauth: ^12.0.2
```

--------------------------------

### Authorize with Generated Nonce

Source: https://pub.dev/packages/flutter_appauth/example

Performs an authorization request including a cryptographically secure nonce.

```dart
Future<void> _signInWithNoCodeExchangeAndGeneratedNonce() async {
    try {
      _setBusyState();
      final Random random = Random.secure();
      final String nonce =
          base64Url.encode(List<int>.generate(16, (_) => random.nextInt(256)));
      // use the discovery endpoint to find the configuration
      final AuthorizationResponse result = await _appAuth.authorize(
        AuthorizationRequest(_clientId, _redirectUrl,
            discoveryUrl: _discoveryUrl,
            scopes: _scopes,
            loginHint: 'bob',
            nonce: nonce),
      );

      _processAuthResponse(result);
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### Handle Platform Exceptions

Source: https://pub.dev/packages/flutter_appauth

Catch FlutterAppAuthPlatformException to access detailed error information provided by the underlying platform's AppAuth SDK.

```dart
try {
  await appAuth.authorize(...);
} on FlutterAppAuthPlatformException catch (e) {
  final FlutterAppAuthPlatformErrorDetails details = e.details;
  // Handle exceptions based on errors from AppAuth.
} catch (e) {
  // Handle other errors.
}
```

--------------------------------

### Authorize and Exchange Code via Issuer

Source: https://pub.dev/packages/flutter_appauth

Perform an authorization request and exchange the code by specifying the issuer, skipping the discovery document retrieval.

```dart
final AuthorizationTokenResponse result = await appAuth.authorizeAndExchangeCode(
                    AuthorizationTokenRequest(
                      '<client_id>',
                      '<redirect_url>',
                      issuer: '<issuer>',
                      scopes: ['openid','profile', 'email', 'offline_access', 'api'],
                    ),
                  );

```

--------------------------------

### Exchange Authorization Code for Token

Source: https://pub.dev/packages/flutter_appauth/example

Exchanges an authorization code for an access token using the discovery URL and code verifier.

```dart
Future<void> _exchangeCode() async {
    try {
      _setBusyState();
      final TokenResponse result = await _appAuth.token(TokenRequest(
          _clientId, _redirectUrl,
          authorizationCode: _authorizationCode,
          discoveryUrl: _discoveryUrl,
          codeVerifier: _codeVerifier,
          nonce: _nonce,
          scopes: _scopes));
      _processTokenResponse(result);
      await _testApi(result);
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### End Session with AppAuth

Source: https://pub.dev/packages/flutter_appauth/example

Terminates the current user session using the provided ID token and optional user agent configuration.

```dart
Future<void> _endSession(
      {ExternalUserAgent externalUserAgent =
          ExternalUserAgent.asWebAuthenticationSession}) async {
    try {
      _setBusyState();
      await _appAuth.endSession(EndSessionRequest(
          idTokenHint: _idToken,
          postLogoutRedirectUrl: _postLogoutRedirectUrl,
          serviceConfiguration: _serviceConfiguration,
          externalUserAgent: externalUserAgent));
      _clearSessionInfo();
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### Manage UI Busy State

Source: https://pub.dev/packages/flutter_appauth/example

Helper methods to toggle the UI busy state and clear error messages.

```dart
void _clearBusyState() {
    setState(() {
      _isBusy = false;
    });
  }

  void _setBusyState() {
    setState(() {
      _error = '';
      _isBusy = true;
    });
  }
```

--------------------------------

### Handle Authentication Errors

Source: https://pub.dev/packages/flutter_appauth/example

Processes various exception types returned by the AppAuth flow, including user cancellation and platform-specific errors.

```dart
void _handleError(Object e) {
    if (e is FlutterAppAuthUserCancelledException) {
      setState(() {
        _error = 'The user cancelled the flow!';
      });
    } else if (e is FlutterAppAuthPlatformException) {
      setState(() {
        _error = e.platformErrorDetails.toString();
      });
    } else if (e is PlatformException) {
      setState(() {
        _error = 'Error\n\nCode: ${e.code}\nMessage: ${e.message}\n'
            'Details: ${e.details}';
      });
    } else {
      setState(() {
        _error = 'Error: $e';
      });
    }
  }
```

--------------------------------

### Perform Authorization without Code Exchange

Source: https://pub.dev/packages/flutter_appauth/example

Initiates an authorization request to obtain an authorization code, optionally using an issuer or discovery URL.

```dart
Future<void> _signInWithNoCodeExchange() async {
    try {
      _setBusyState();
      /* 
        The discovery endpoint (_discoveryUrl) is used to find the
        configuration. The code challenge generation can be checked here 
        > https://github.com/MaikuB/flutter_appauth/search?q=challenge.
        The code challenge is generated from the code verifier and only the
        code verifier is included in the result. This because to get the token
        in the method _exchangeCode (see above) we need only the code verifier
        and the authorization code.
        Code challenge is not used according to the spec
        https://www.rfc-editor.org/rfc/rfc7636 page 9 section 4.5.
      */
      final AuthorizationResponse result = await _appAuth.authorize(
        AuthorizationRequest(_clientId, _redirectUrl,
            discoveryUrl: _discoveryUrl, scopes: _scopes, loginHint: 'bob'),
      );

      /* 
        or just use the issuer
        var result = await _appAuth.authorize(
          AuthorizationRequest(
            _clientId,
            _redirectUrl,
            issuer: _issuer,
            scopes: _scopes,
          ),
        );
      */

      _processAuthResponse(result);
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### End User Session

Source: https://pub.dev/packages/flutter_appauth

Trigger an end session request to log the user out of the built-in browser using an end session endpoint.

```dart
await appAuth.endSession(EndSessionRequest(
          idTokenHint: '<idToken>',
          postLogoutRedirectUrl: '<postLogoutRedirectUrl>',
          serviceConfiguration: AuthorizationServiceConfiguration(authorizationEndpoint: '<authorization_endpoint>', tokenEndpoint: '<token_endpoint>', endSessionEndpoint: '<end_session_endpoint>')));
```

--------------------------------

### Refresh Access Token

Source: https://pub.dev/packages/flutter_appauth/example

Uses a refresh token to obtain a new access token from the identity provider.

```dart
Future<void> _refresh() async {
    try {
      _setBusyState();
      final TokenResponse result = await _appAuth.token(TokenRequest(
          _clientId, _redirectUrl,
          refreshToken: _refreshToken, issuer: _issuer, scopes: _scopes));
      _processTokenResponse(result);
      await _testApi(result);
    } catch (e) {
      _handleError(e);
    } finally {
      _clearBusyState();
    }
  }
```

--------------------------------

### Clear Session Information

Source: https://pub.dev/packages/flutter_appauth/example

Resets the local state and clears text controllers after a session is terminated.

```dart
void _clearSessionInfo() {
    setState(() {
      _codeVerifier = null;
      _nonce = null;
      _authorizationCode = null;
      _authorizationCodeTextController.clear();
      _accessToken = null;
      _accessTokenTextController.clear();
      _idToken = null;
      _idTokenTextController.clear();
      _refreshToken = null;
      _refreshTokenTextController.clear();
      _accessTokenExpirationTextController.clear();
      _userInfo = null;
    });
  }
```

--------------------------------

### Handle User Cancellation in Flutter AppAuth

Source: https://pub.dev/packages/flutter_appauth

Catch the FlutterAppAuthUserCancelledException to gracefully handle scenarios where a user closes the browser window during the authorization flow.

```dart
try {
  await appAuth.authorize(...); // Or authorizeAndExchangeCode(...)
} on FlutterAppAuthUserCancelledException catch (e) {
  // Handle user cancellation
}
```
Tokens:
Raw