Mobile Session Management
Descope extends support to mobile application development by offering SDKs tailored for Swift, Kotlin, and more. These SDKs incorporate robust token storage methodologies, utilizing the secure environment of the each device locally.
This guide shows how to effectively implement session validation and manage the tokens on your mobile app, with our Mobile SDKs.
The session management article gives an overview of the session validation in Descope.
If you're looking to set up backend validation, check out our Backend Validation page.
How Token Storage Works with Mobile SDKs
With Descope's Mobile SDKs at your disposal, you can bypass the necessity of manually saving tokens on the device. The SDKs, designed to cater to the unique needs of each platform, handle token storage and retrieval in an unobtrusive and secure manner in the background.
Swift
For Swift-based applications, Descope SDK uses iOS's Keychain Services to store, retrieve and manage the session and refresh tokens. Keychain Services provide a secure, encrypted storage mechanism for sensitive user information, including Descope tokens.
Kotlin
Descope's Kotlin SDK employs Android's native EncryptedSharedPreferences
to securely store session and refresh tokens locally.
The EncryptedSharedPreferences
provide a robust, encrypted storage environment
to protect sensitive user information, such as Descope tokens.
Flutter
Similarly, for Flutter applications, session and refresh tokens are stored using the native keychain on iOS and EncryptedSharedPreferences on Android, providing a secure storage solution.
Using our SDKs
Install SDK
Import and initialize SDK
Sending session token to application server
If you are using Mobile SDK or using Descope Flows, then your application must send the session token to you application server.
The getSessionToken()
function gets the sessionToken
from local storage via JS which you can then include in your request.
At any time, your application should only send the session token to your application and the application server should validate the session token using Descope Backend SDK.
Logout using Mobile SDK
If you are integrating using the Descope Mobile SDK, then you must use the Mobile SDK to logout. If you are using Descope Flows with React SDK, refer to the Quick Start for details. If you are Descope Mobile SDK without flows, then refer to the sample code below for logout.
Checking token expiration
One important step in validating a session token is to ensure that the token has not expired. Descope's WebJS SDK includes a method isJwtExpired
for this purpose.
Handling Authorization
Get Roles from Session Token
Depending on your application's requirements, you might need to know the roles of a user from their session token. Descope's SDKs provides the getJwtRoles
function for this purpose.
Get Permissions from Session Token
Depending on your application's requirements, you might need to know the permissions of a user from their session token. Descope's SDKs provides the getJwtPermissions
function for this purpose.
Starting a managed session
After a user finishes a sign in flow successfully you should create
a DescopeSession
object from the AuthenticationResponse
value returned
by all the authentication APIs.
Authenticate outgoing requests
The session can then be used to authenticate outgoing requests to your backend with a bearer token authorization header.
Using the session JWT directly
If your backend uses a different authorization mechanism you can of course use the session JWT directly instead of the extension function:
Descope User
The DescopeUser
struct represents an existing user in Descope.
After a user is signed in with any authentication method the DescopeSession
object
keeps a DescopeUser
value in its user
property so the user's details are always
available.
In the example below we finalize an OTP authentication for the user by verifying the
code. The authentication response has a user
property which can be used
directly or later on when it's kept in the DescopeSession
.
For instance, you can use the DescopeUser
object to access
the userId
, loginIds
, name
, picture
, email
,
verifiedEmail
, phone
, verifiedPhone
, createdTime
, and customAttributes
.
The details for a signed in user can be updated manually by calling auth.me
with
the refreshJwt
from the active DescopeSession
. If the operation is successful the call
returns a new DescopeUser
value.
The DescopeUser struct contains the following attributes: