OAuth for native iOS and Android apps

Native apps are public clients: they cannot keep a client secret. Use authorization code with PKCE and launch Lunch Money sign-in and consent in a trusted platform authentication browser—not an embedded WebView.

Recommended libraries

• iOS and macOS: AppAuth-iOS, presented through ASWebAuthenticationSession.
• Android: AppAuth-Android, which uses a browser Custom Tab.
• Bare or non-Expo React Native: react-native-app-auth.
• Expo: Use expo-auth-session for browser-based OAuth flows.

Use Lunch Money's authorization-server discovery document and configure token_endpoint_auth_method=none. Send the client ID at the token and revocation endpoints, but never invent or embed a client secret. You do not need to configure authorization-request scopes because the registered client receives its complete fixed set. If your OAuth library sends scope, Lunch Money ignores that value and uses the registered set.

Redirects

Use a redirect mechanism that returns control to your app and that your platform can bind to it. Claimed Universal Links or Android App Links provide stronger app ownership than a custom URI scheme when correctly configured. Custom schemes must be distinctive and protected against interception.

The loopback callbacks supported for confidential web development do not define native or desktop redirect support. Follow the native redirect choices accepted during client registration; do not assume the confidential web-client loopback rules apply.

Store and renew tokens

Store tokens in Keychain on Apple platforms. On Android, use current Keystore-backed storage guidance from your maintained library; do not start new work with deprecated EncryptedSharedPreferences APIs. Coordinate refresh-token use, persist replacements, and fall back to interactive authorization after terminal failure.

Platform code should delegate protocol validation to the maintained library while your application supplies safe configuration, lifecycle storage, API calls, revocation, and user-facing recovery. Full Lunch Money Swift and Kotlin sample apps are not part of this documentation phase; the upstream AppAuth projects provide maintained platform examples.

Next: Review OAuth security guidance.