{"id":19645768,"url":"https://github.com/approov/appauth-oauth2-approov","last_synced_at":"2026-03-14T10:41:43.078Z","repository":{"id":45505235,"uuid":"116162166","full_name":"approov/AppAuth-OAuth2-Approov","owner":"approov","description":"Strengthens OAuth2 authorization by using mobile app attestation","archived":false,"fork":false,"pushed_at":"2024-10-19T19:00:23.000Z","size":740,"stargazers_count":2,"open_issues_count":4,"forks_count":2,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-04-05T09:11:18.822Z","etag":null,"topics":["api-security","approov","approov-mobile-quickstart","mobile","mobile-security"],"latest_commit_sha":null,"homepage":"https://approov.io","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/approov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-01-03T17:09:05.000Z","updated_at":"2024-08-05T12:53:15.000Z","dependencies_parsed_at":"2024-11-11T14:49:15.431Z","dependency_job_id":null,"html_url":"https://github.com/approov/AppAuth-OAuth2-Approov","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2FAppAuth-OAuth2-Approov","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2FAppAuth-OAuth2-Approov/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2FAppAuth-OAuth2-Approov/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2FAppAuth-OAuth2-Approov/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/approov","download_url":"https://codeload.github.com/approov/AppAuth-OAuth2-Approov/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251330549,"owners_count":21572306,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-security","approov","approov-mobile-quickstart","mobile","mobile-security"],"created_at":"2024-11-11T14:35:11.300Z","updated_at":"2026-03-14T10:41:43.033Z","avatar_url":"https://github.com/approov.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Strengthening OAuth2 for Mobile Clients\n\n[OAuth2](https://oauth.net/2/), often combined with\n[OpenID-Connect](http://openid.net/connect/), is a popular authorization \nframework that enables applications to protect resources from unauthorized access. \nIt delegates user authentication to an authorization service, which then authorizes \nthird-party applications to access the protected resources on the user’s behalf. OAuth2 \nprovides authorization flows for both web and mobile applications.\n\nOAuth2's most popular flow is the authorization code grant flow which is used to authorize \nconfidential clients access to protected resources. Clients use a `client_id` to identify \nthemselves and a `client_secret` to authenticate themselves to the authorization service.\n\nUnfortunately, native mobile clients are not good at keeping static secrets. \nSince a public client secret is no secret at all, many identity and authorization \nservice providers simply drop the client secret. Either way, without proper client\nauthentication, the OAuth2 flow is subject to code exchange attacks and/or client app\nimpersonation.\n\nA dynamic app authentication service such as [Approov](https://www.approov.io/demo-reg.html), \nwhich is freely used in this demo, can be used to reintroduce confidential client\nauthentication into the mobile client OAuth2 flow.\n\n### AppAuth\n\n[AppAuth](https://appauth.io/) is an open source SDK for native Android and iOS\napps which implements best-practice [OAuth2](https://tools.ietf.org/html/rfc6749) \nand [OpenID-Connect](http://openid.net/specs/openid-connect-core-1_0.html) (OIDC) \nspecifications in a platform friendly manner.\n\nThe SDK follows [OAuth 2.0 for Native Apps](https://tools.ietf.org/html/draft-ietf-oauth-native-apps) best practices,\nincluding the [PKCE](https://tools.ietf.org/html/rfc7636) extension and custom\ntab browsers. The library provides hooks to further extend the protocol beyond\nthe basic flow.\n\nAs an open source project, [AppAuth](https://appauth.io/) has GitHub\nrepositories for [Android](https://github.com/openid/AppAuth-Android) and\n[iOS](https://github.com/openid/AppAuth-iOS) which include good documentation, a\ndemo app, and integration with multiple authorization services.\n\n### Getting Started\n\nA sample app, implemented in Android, provides a concrete example using AppAuth\nand Approov to authorize access to private resources. The Books App uses the Google Books\nAPI and *Google* Sign-In services to search for books (protected by API key) and\nshow a signed-in user’s favorite book selections (protected by OAuth2). \nThe app was developed on Android to\nfurther explore AppAuth SDK usage with a common application architecture and\nsupport libraries.\n\nAn OAuth2 adapter, implemented in node, is used to add Approov app authentication into the existing Google OAuth2\ncode grant flow. \n\nTo follow along, start by cloning the AppAuth-OAuth2-Approov project on GitHub available at\n[github.com/approov](https://github.com/approov). It requires some\nconfiguration, so it will not run out of the box. At a minimum, you will need to\nprovide a keystore, Google API key, and Google OAuth2 credentials.\n\nSee the article **Strengthening OAuth2 for Mobile** at the [Approov blog](https://approov.io/blog) or on [Medium](https://medium.com/@skiph) \nfor instructions on how to get the app and adpater service running.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fappauth-oauth2-approov","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapproov%2Fappauth-oauth2-approov","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fappauth-oauth2-approov/lists"}