Expo AuthSession

Load an authorization request for a code. When the prompt method completes then the response will be fulfilled.

In order to close the popup window on web, you need to invoke WebBrowser.maybeCompleteAuthSession(). See the Identity example for more info.

If an Implicit grant flow was used, you can pass the response.params to TokenResponse.fromQueryParams() to get a TokenResponse instance which you can use to easily refresh the token.

const [request, response, promptAsync] = useAuthRequest({ ... }, { ... });

Given an OpenID Connect issuer URL, this will fetch and return the DiscoveryDocument (a collection of URLs) from the resource provider.

const discovery = useAutoDiscovery('https://example.com/auth');

Access token request. Exchange an authorization code for a user access token.

Section 4.1.3

Represents an authorization response error: Section 5.2. Often times providers will fail to return the proper error message for a given error code. This error method will add the missing description for more context on what went wrong.

Used to manage an authorization request according to the OAuth spec: Section 4.1.1. You can use this class directly for more info around the authorization.

Common use-cases:

• Parse a URL returned from the authorization server with parseReturnUrlAsync().
• Get the built authorization URL with makeAuthUrlAsync().
• Get a loaded JSON representation of the auth request with crypto state loaded with getAuthRequestConfigAsync().

// Create a request.
const request = new AuthRequest({ ... });

// Prompt for an auth code
const result = await request.promptAsync(discovery);

// Get the URL to invoke
const url = await request.makeAuthUrlAsync(discovery);

// Get the URL to invoke
const parsed = await request.parseReturnUrlAsync("<URL From Server>");

Refresh request.

Section 6

Section 4.1.2.1

Revocation request for a given token.

Section 2.1

Section 4.1.2.1

A generic token request.

Token Response.

Section 5.1

Cancels an active AuthSession if there is one.

Exchange an authorization code for an access token that can be used to get data from the provider.

Fetch a DiscoveryDocument from a well-known resource provider that supports auto discovery.

Fetch generic user info from the provider's OpenID Connect userInfoEndpoint (if supported).

See: UserInfo.

Returns the current time in seconds.

Get the URL that your authentication provider needs to redirect to. For example: https://auth.expo.io/@your-username/your-app-slug. You can pass an additional path component to be appended to the default redirect URL.

Note This method will throw an exception if you're using the bare workflow on native.

const url = AuthSession.getRedirectUrl('redirect');

// Managed: https://auth.expo.io/@your-username/your-app-slug/redirect
// Web: https://localhost:19006/redirect

Append the well known resources path and OpenID connect discovery document path to a URL https://tools.ietf.org/html/rfc5785

Build an AuthRequest and load it before returning.

Create a redirect url for the current platform and environment. You need to manually define the redirect that will be used in a bare workflow React Native app, or an Expo standalone app, this is because it cannot be inferred automatically.

• Web: Generates a path based on the current window.location. For production web apps, you should hard code the URL as well.
• Managed workflow: Uses the scheme property of your app config.
• Bare workflow: Will fallback to using the native option for bare workflow React Native apps.

const redirectUri = makeRedirectUri({
  scheme: 'my-scheme',
  path: 'redirect'
});
// Development Build: my-scheme://redirect
// Expo Go: exp://127.0.0.1:8081/--/redirect
// Web dev: https://localhost:19006/redirect
// Web prod: https://yourwebsite.com/redirect

const redirectUri2 = makeRedirectUri({
  scheme: 'scheme2',
  preferLocalhost: true,
  isTripleSlashed: true,
});
// Development Build: scheme2:///
// Expo Go: exp://localhost:8081
// Web dev: https://localhost:19006
// Web prod: https://yourwebsite.com

Refresh an access token.

• If the provider didn't return a refresh_token then the access token may not be refreshed.
• If the provider didn't return a expires_in then it's assumed that the token does not expire.
• Determine if a token needs to be refreshed via TokenResponse.isTokenFresh() or shouldRefresh() on an instance of TokenResponse.

See: Section 6.

Utility method for resolving the discovery document from an issuer or object.

Revoke a token with a provider. This makes the token unusable, effectively requiring the user to login again.