authenticate with token / refreshtoken from mobile app in webview

[Cantinaband]

Question 💬

Hey everyone,

we are using next-auth for our website and react-native-app-auth for our mobile app. Both use the same auth-provider.

In the mobile app, the user can open the website in a webview and should automatically sign in. The mobile app has a refresh-token & access token.

How to reproduce ☕️

My first idea would be to pass the refresh-token as URL param to the website and authenticate the user with the next-auth based on this refresh-token-param. But nor sure how to handle within the next-auth. Is there a better solution?

Thanks for any input

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

[Cantinaband]

Pretty simple.

You can call /api/auth/callback/<auth_provider>?id_token=<idToken>&refresh=<refreshToken>&callbackUrl=<callbackUrl>

This triggers the next-auth jwt function. I checked the normal response from the auth-provider first to get the structure of the params. But that's it

See more here: https://next-auth.js.org/configuration/callbacks#jwt-callback

[HermesDE]

Hey,

where did you get the refreshToken from?

[robin-thoene]

Hey,

I use azure ad b2c and using your method I receive an error:
"State cookie was missing."

I can set "checks: ['none']" in the provider, but than I receive the error:
"Error refreshing access token; invalid_grant; AADB2C90090: The provided JWE is not a valid 5 segment token"

Do you know why this happens?

[kirkegaard]

Im doing a similar thing. Only problem is that we dont have id_token available. Is there a way of doing the same thing but without that specific param?