Mobile apps and push authentication
Native apps sign in through the system browser with PKCE and come back with a token. The LumoAuth mobile app adds something a password cannot: a device-bound key that approves sign-ins, step-up challenges and agent permission requests with a fingerprint.
Mobile login is easy to get subtly wrong
Embedded web views, long-lived tokens in app storage and SMS codes as the only second factor are common and all weak.
How LumoAuth solves it
PKCE through the system browser
The React Native quickstart and the native guides follow the OAuth best practice for native apps. Docs
Push approval
A sign-in request appears on the phone with location and device; the user approves with biometrics. Requests expire after two minutes. Docs
Device-bound keys
Each enrolled phone holds a P-256 key in secure hardware. Approvals are signed; the server verifies the signature and a challenge nonce. Docs
Approve agent requests on the go
The same app shows just-in-time requests from agents with their risk level. Docs
Sign in on a TV or CLI
Devices without a browser show a code; the user confirms it on their phone. Docs
Sessions and devices
Users see and revoke their devices from their account page. Docs
Setting it up
Create a native application
Public client, PKCE, custom-scheme or universal-link redirect.
Integrate the SDK
React Native, or any OpenID Connect library on iOS and Android.
Enable push
Users enroll the LumoAuth app from their account page.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- OAuth for native apps
- RFC 8252
- PKCE
- RFC 7636
- Device authorization
- RFC 8628
- Backchannel authentication
- OpenID CIBA
Which plan you need
Native sign-in, device flow and push authentication are on every plan, including the free Developer plan.
Documentation
Questions
Is the push app available in the stores?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.