Developer preview

Mobile SDKs

Add Continue with UnifyID to Android, Flutter, React Native, and Apple applications without placing passwords, face capture, or Client Secrets inside your application.

The unifyid-mobile-sdk repository contains platform adapters, shared OAuth contracts, integration examples, and protocol tests. Every platform launches the hosted UnifyID experience through its operating-system authentication browser and completes Authorization Code with S256 PKCE.

Supported packages

Platform	Package	Authorization surface
Android / Kotlin	`unifyid-android`	Android Custom Tabs with PKCE
Flutter	`unifyid_flutter`	Native AppAuth on Android and iOS
React Native	`@unifyid/react-native`	Native AppAuth bridge
iOS / Swift	`UnifyID`	`ASWebAuthenticationSession`

Current distribution. The SDK is a developer-preview workspace package. Integrate from the repository while package registry publication and versioned release channels are prepared.

Common configuration

clientId: vid_sandbox_replace_me
redirectUri: https://mobile.example.com/oauth/callback
scopes:
  - openid
  - profile
  - email
  - identity_verified
authorizationEndpoint: https://api.dev.unifyid.io/v1/oauth/authorize
tokenEndpoint: https://api.dev.unifyid.io/v1/oauth/token

Platform setup

1Create a public Sandbox application
2Register the exact HTTPS mobile callback
3Associate the callback domain with the Android package or Apple application
4Configure the SDK with Client ID and minimum scopes
5Open authorization in the native browser session
6Validate state and exchange with the original PKCE verifier
7Store tokens in platform-protected storage
8Handle denial, cancellation, expiry, and revoked consent

Flutter example

final unifyID = UnifyID(const UnifyIDConfig(
  clientId: String.fromEnvironment("UNIFYID_CLIENT_ID"),
  redirectUrl: "https://mobile.example.com/oauth/callback",
  scopes: ["openid", "profile", "email", "identity_verified"],
));

final authorization = await unifyID.authorize();

Android / Kotlin

Open packages/android-kotlin in Android Studio, configure a verified HTTPS App Link, and use UnifyIDClient.authorize. The callback must be completed with the original locally protected transaction.

iOS / Swift

Add packages/ios-swift as a Swift Package, configure an associated Universal Link, and call UnifyIDClient.authorize(anchor:). Authorization uses ASWebAuthenticationSession.

React Native example

const session = await continueWithUnifyID({
  clientId: Config.UNIFYID_CLIENT_ID,
  redirectUrl: "https://mobile.example.com/oauth/callback",
  scopes: ["openid", "profile", "email", "identity_verified"],
});

Mobile security requirements

Apply every control below before distributing a mobile application that connects to UnifyID.

Client type

Keep secrets off the device

Mobile applications are public clients. Never issue, bundle, or transmit a Client Secret to the application.

Transaction

Bind every authorization attempt

Use S256 PKCE with a newly generated state and nonce for every authorization transaction.

Callback

Use verified application links

Return through verified HTTPS Android App Links or Apple Universal Links owned by your application.

Browser

Use the system authorization session

Never place UnifyID authorization inside a general-purpose or embedded WebView.

Storage

Protect tokens at rest

Store tokens only in Keychain or Android Keystore-backed secure storage.

Cleanup

Remove unfinished transactions

Clear incomplete transaction data immediately after cancellation, failure, or expiry.

Repository

From unifyid-mobile-sdk, run npm install followed by npm run check for the JavaScript packages and contract tests. Flutter uses flutter pub get and flutter analyze; Android can be compiled in Android Studio, and Swift tests require macOS with Xcode.