TL;DR
- Auth0 provides API Authentication and Authorization as a means to secure access to API endpoints (see API Authentication and Authorization)
- For authorizing a mobile app user and granting access to the API, Auth0 supports the Authorization Code Flow with Proof Key for Code Exchange (PKCE) (see Proof Key for Code Exchange)
- Both the mobile app and the API must be configured in the Auth0 Dashboard (see Auth0 Configuration)
- User Permissions can be enforced using the Authorization Extension (see Configure the Authorization Extension)
- The API is secured by ensuring that a valid is passed in the HTTP Authorization header when calls are made to the API (see Implement the API)
- The Auth0.Android SDK can be used to authorize the user of the mobile app and obtain a valid Access Token which can be used to call the API (see Authorize the User)
- The mobile app can retrieve the user’s profile information by decoding the ID Token (see Get the User Profile)
- UI Elements can be displayed conditionally based on the scope that was granted to the user (see Display UI Elements Conditionally Based on Scope)
- The mobile app provides the Access Token in the HTTP Authorization header when making calls to the API (see Call the API)
- The mobile app user’s Access Token can be renewed to ensure the user does not have to log in again during a session (see Renew the Token)