Native Flows

While many other Auth Providers rely on opening external web pages for authentication, Descope's Native Flows elevate the user experience by embedding authentication flows directly into your mobile app, creating a seamless experience that feels fully native.

Native flows require a flow to be hosted within a web application (either by using our Auth Hosting app or a self-hosted page), but integrate that content into your app via a webview. This preserves the flexibility and scalability of hosted authentication, while delivering a polished, in-app experience that feels fully native.

How Native Flows Work

Native flows provide an integrated authentication experience:

Running Hosted Flow:
The authentication flow is served remotely for secure and stable hosting without extra infrastructure on your part.
Embedded via Webview:
Instead of redirecting users to an external browser, the hosted authentication page is displayed inside a webview, making it feel like a natural part of your app.
Enhanced Control & Customization:
You can preload flows, add custom animations, and control the entire transition within the native app environment, leveraging the flexibility of hosted pages without sacrificing control.
Seamless UX:
Users remain inside the app, maintaining consistent branding and style. The authentication step feels integrated rather than an external detour.

Different Native Flows

Below are general approaches you might choose with Descope's mobile SDK. Each still uses a hosted authentication page displayed in a webview, ensuring a cohesive experience:

native flow experiences

Simple Flow: Pushes a DescopeFlowViewController onto your navigation stack, immediately presenting the hosted flow in a full screen native webview.
Modal Flow: Preloads a DescopeFlowViewController, so when the user initiates sign-in, the flow appears in a modal instantly. This creates a smooth, uninterrupted experience. This also does not fill the entire screen like the simple flow does, and mimicks the browser modal a bit more, without the annoying browser related buttons.
Inline Flow: Integrates a DescopeFlowView directly into your app's view hierarchy. This approach allows for fully custom animations and transitions, making the flow feel like an organic part of your UI.

All these approaches keep the user within your app's environment rather than switching to an external browser, ensuring consistent branding, better control, and a smoother user experience.

Touch Interactions

Because a native flow renders inside a webview, it would otherwise carry over touch behaviors that belong to a web browser rather than a native app. To keep the flow feeling native, the mobile SDKs automatically suppress these interactions as soon as the flow is ready.

Some examples of these touch behaviors include:

Text selection is disabled: Users can't drag-select or highlight text within the flow.
The long press callout is suppressed on iOS: Long pressing a link or an image no longer opens the system menu with Copy, Look Up, and Share actions.
Links and images can't be dragged: Links inside text components, along with any images on the screen, are marked as non-draggable so they can't be dragged out of the flow.

Tapping a link is unaffected and continues to work as expected.

Disabling with SDKs

The rules differ per platform, since the properties that control these behaviors are platform-specific:

#content-root * {
  -webkit-touch-callout: none;
  -webkit-user-select: none;
}

The rules are scoped to the flow's content root, so they affect the flow itself and nothing else on the page.

/* applied to the hosted page */
* {
  user-select: none;
}

/* applied within the flow's content root */
#content-root * {
  user-select: none;
}

On Android the SDK also adds a page-level rule, so text selection is disabled across the entire hosted page rather than only inside the flow. Keep this in mind if you self-host your flow page and render your own content around the flow.

Note

When using Native Flows, text selection is typically disabled.

If any screen in your flow displays a value a user might need to copy, such as an OTP or string shown in a read-only input, you should enable the Allow copying value setting on that input component. This renders a copy icon next to the field, giving users a way to copy the value without relying on text selection.

Authentication Methods with Native Flows

Native Flows work seamlessly with various authentication methods. Native OAuth, Passkeys, and Magic Link all integrate smoothly with Native Flows, though they require additional configuration to set up properly.

OAuth: Social login providers like Google, Facebook, and Apple can be integrated with Native Flows. The OAuth handshake is handled securely while maintaining the native app experience.
Passkeys: Biometric authentication and passkeys work seamlessly with Native Flows, providing a secure and user-friendly authentication experience.
Magic Link: Magic link authentication integrates with Native Flows, allowing users to authenticate via email or SMS links while staying within your app.

For methods that inherently rely on browser interactions, Descope's Native Flow handles these gracefully. Under the hood, it may open a secure, controlled browser session that fits naturally into the native flow, preserving a unified look and feel.

Managing Sessions and Authentication State

Beyond the flow itself, proper session management ensures that users remain seamlessly authenticated without repeatedly entering credentials.

If your project is configured to manage tokens in cookies — session tokens and/or refresh tokens — with a custom domain, native flows receive those JWTs as cookies set inside the webview instead of in the authentication response body.

Because cookies are scoped to a specific domain and path, the SDK cannot assume the tokens live on the exact domain serving the flow. To resolve this, the mobile SDK extracts the cookie location directly from the authentication response to locate the tokens:

cookieDomain: The domain the authentication cookies are scoped to.
cookiePath: The path the authentication cookies are scoped to.

The SDK resolves cookies by checking the specified domain and path first, then falling back to the flow's URL if no location is configured. Because of this fallback, the flow's host page is not required to match the exact domain your cookies are scoped to. For example, a flow served from Auth Hosting can successfully hand off tokens scoped to auth.example.com.

If you set a custom Refresh Cookie Name or Session Cookie Name in your flow's End action, native flows honor it automatically - no additional SDK configuration is required.

To use this feature, ensure the following are configured:

Enable Token Response Methods for cookies on the Session Management page, following the steps in the custom domain guide.
During SDK initialization, set the baseUrl to route requests through your custom domain, this ensures refresh cookies are sent correctly during session refreshes. See Mobile SDK Auth Helpers for details.

iOS with ASWebAuthenticationSession

On iOS, ASWebAuthenticationSession can enhance session management in scenarios that require browser-based capabilities (such as OAuth). It provides a secure environment to handle authentication sessions while still allowing the app to control aspects like timeouts, tokens, and redirects. When combined with Native Flows, it ensures that even browser-dependent authentication methods (like certain OAuth providers) integrate smoothly without forcing a full browser context switch. This means your iOS app can benefit from secure, system-level session handling while still presenting a native and cohesive UX.

Android with DescopeSessionManager

On Android, Descope offers the DescopeSessionManager class to manage authenticated user sessions. It takes care of loading and saving session data, securely storing it with EncryptedSharedPreferences, and refreshing sessions before they expire. By initializing Descope with your applicationContext and managing sessions with DescopeSessionManager, you can ensure that users stay signed in across app launches and have their tokens refreshed automatically.

By leveraging DescopeSessionManager, you get:

Auto-Refresh: Sessions refresh automatically before expiration.
Secure Storage: Sessions and tokens are stored in encrypted preferences.
Persistent Auth State: The user remains signed in across app restarts, and you can easily revoke or clear sessions when they sign out.

This seamless integration of session management helps you deliver a stable, user-friendly authentication experience without manual token handling.

Conclusion

Descope's Native Flows provide the best of both worlds: reliability and maintainability of hosted authentication pages, combined with the control and seamless feel of a fully native UI. With easy access to session management tools on both iOS and Android, you can deliver a top-tier authentication experience without compromising on security, scalability, or branding.

By integrating Native Flows, session management tools like DescopeSessionManager, and leveraging platform-specific frameworks such as ASWebAuthenticationSession, developers can create authentication journeys that users trust, appreciate, and remember.

To learn how to integrate Native Flows in your Swift or Kotlin applications, visit the respective quickstart guides.

Was this helpful?

Native Flows

On this page