Visual RFC.
ALL RFCs / RFC 8252
Read the RFC ↗

RFC 8252 / START HERE

OAuth for native apps, before the details

OAuth for native apps

A native app is software installed on a phone or computer. This RFC explains how those apps should ask for OAuth permission using a separate browser.

Start the guide See the 9 chapters ↓

The idea in one picture

  1. An installed app asks

  2. A browser handles approval

  3. The result returns to the app

A simplified picture of the idea; the chapters explain the actual mechanisms.

Why it exists

An app-controlled login screen could inspect what you type. An external browser keeps the authorization service's sign-in experience separate from the app.

A familiar example

A desktop app opens your browser to connect a cloud account, then receives a callback after you approve access.

Helpful background

You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.

OAuth 2.0RFC 6749 · beginner overview ↗PKCERFC 7636 · beginner overview ↗

What you’ll learn next

Begin with chapter one, or choose a topic.

  1. Leave login to the browserThe app delegates authentication to a separate browser security context.
  2. A browser round trip, protected by PKCEProof Key for Code Exchange (PKCE) lets an installed app prove it knows a fresh secret when exchanging a code.
  3. Private-use callback schemesA domain-based custom URI scheme lets the operating system return a code to an installed app.
  4. Claimed HTTPS callbacksThe operating system can associate a domain’s HTTPS links with its verified app.
  5. Loopback callbacks on desktopA temporary local listener can receive the browser’s authorization response.
  6. Register the full callbackRecord a native app’s client type and exact redirect URI, including its path.
  7. Bind the response to the app’s requestA callback arriving on the device must correspond to an outstanding authorization request.
  8. Fake browsers and client impersonationA malicious app can mimic a browser or attempt to become the default HTTPS handler.
  9. Server support and implicit-flow limitsSupporting native apps means more than accepting one mobile callback format.
Start with chapter one →

This introduction explains RFC 8252 (2017). Read the original RFC ↗