Mobile Authentication
Purpose
Plan authentication: sign-in/up flows, token/session lifecycle (issue, store, refresh, revoke), and secure token storage — coordinated with the API layer and the chosen provider.
When to Use
- When the app has user accounts or protected content.
- Not for authorization/role checks (that's
mobile-authorization).
Inputs
- Auth provider/model (custom JWT, Supabase/Firebase, Clerk/Auth0).
- API integration and secure storage.
Discovery Questions
- Which auth provider/model is used?
- How are tokens issued, refreshed, and revoked?
- Where are tokens stored securely (
mobile-secure-storage)?
- What are the session-expiry and logout behaviors?
Responsibilities
Credential input rules (email normalization, password policy, confirm match) come from ../../auth-form-validation — one schema, enforced on the server too.
Plan login/signup and session establishment.
Handle token lifecycle: issue, secure storage, refresh, revoke on logout.
Attach tokens via the API layer (mobile-api-integration).
Coordinate protected routes (mobile-authorization, mobile-navigation).
Document the unit as it is built — docs/mobile/screens/ (the auth screens) — permissions and failure modes included (../../application-documentation).
Required Workflow
- Confirm provider/model + token lifecycle.
- Plan login/signup + session establishment.
- Store tokens securely; wire refresh + logout.
- Attach tokens in the API interceptor.
- Record the auth plan.
Decision Rules
- Store tokens in secure storage (Keychain/Keystore), never in plain async storage or app state alone.
- Refresh centrally in the API layer; don't scatter refresh logic.
- Client auth gates UX; the server enforces access (
../../security-review).
Rules
- Secure token storage (
mobile-secure-storage); no tokens in logs.
- No hard-coded credentials/secrets.
- Coordinate enforcement with the backend; client checks are not security.
Anti-Patterns
- Tokens in plain async storage or logs.
- Scattered refresh logic.
- Treating client-side auth as the security boundary.
- Hard-coded credentials.
Validation Checklist
Definition of Done
A recorded authentication plan: login/signup, secure token lifecycle with refresh and logout, API-layer attachment, and protected-route coordination — with server-side enforcement authoritative.
Related Skills
mobile-authorization, mobile-secure-storage, mobile-api-integration, mobile-navigation, ../../security-review, ../../application-documentation.
Related Knowledge
../../../knowledge/ (auth model, trust boundaries).
Related References
../../../references/mobile/native/ when populated.
Context Loading Guidance
- Requires: auth provider/model, API layer, secure storage.
- Does not require: unrelated screens, the full mobile skill set, unrelated references.
- May load:
mobile-secure-storage, mobile-api-integration, mobile-authorization.
- Stop when: the auth plan is recorded.
Token Efficiency Guidance
Plan the token lifecycle and provider; delegate storage/transport to their skills.
1---2name: mobile-authentication3description: Use to plan mobile authentication — login/signup, token/session handling, secure token storage, refresh, and logout — coordinating with secure storage, API integration, and the auth provider. Client auth is UX; the server enforces.4---56# Mobile Authentication78## Purpose910Plan authentication: sign-in/up flows, token/session lifecycle (issue, store, refresh, revoke), and secure token storage — coordinated with the API layer and the chosen provider.1112## When to Use1314- When the app has user accounts or protected content.15- Not for authorization/role checks (that's `mobile-authorization`).1617## Inputs1819- Auth provider/model (custom JWT, Supabase/Firebase, Clerk/Auth0).20- API integration and secure storage.2122## Discovery Questions2324- Which auth provider/model is used?25- How are tokens issued, refreshed, and revoked?26- Where are tokens stored securely (`mobile-secure-storage`)?27- What are the session-expiry and logout behaviors?2829## Responsibilities3031- Credential **input rules** (email normalization, password policy, confirm match) come from `../../auth-form-validation` — one schema, enforced on the server too.3233- Plan **login/signup** and session establishment.34- Handle **token lifecycle**: issue, **secure storage**, **refresh**, revoke on logout.35- Attach tokens via the **API layer** (`mobile-api-integration`).36- Coordinate **protected routes** (`mobile-authorization`, `mobile-navigation`).37- Document the unit as it is built — `docs/mobile/screens/` (the auth screens) — permissions and failure modes included (`../../application-documentation`).3839## Required Workflow40411. Confirm provider/model + token lifecycle.422. Plan login/signup + session establishment.433. Store tokens securely; wire refresh + logout.444. Attach tokens in the API interceptor.455. Record the auth plan.4647## Decision Rules4849- Store tokens in secure storage (Keychain/Keystore), never in plain async storage or app state alone.50- Refresh centrally in the API layer; don't scatter refresh logic.51- Client auth gates UX; the server enforces access (`../../security-review`).5253## Rules5455- Secure token storage (`mobile-secure-storage`); no tokens in logs.56- No hard-coded credentials/secrets.57- Coordinate enforcement with the backend; client checks are not security.5859## Anti-Patterns6061- Tokens in plain async storage or logs.62- Scattered refresh logic.63- Treating client-side auth as the security boundary.64- Hard-coded credentials.6566## Validation Checklist6768- [ ] Provider/model confirmed.69- [ ] Login/signup + session planned.70- [ ] Tokens stored securely; refresh + logout wired.71- [ ] Tokens attached via API layer.72- [ ] Server enforcement noted as authoritative.7374## Definition of Done7576A recorded authentication plan: login/signup, secure token lifecycle with refresh and logout, API-layer attachment, and protected-route coordination — with server-side enforcement authoritative.7778## Related Skills7980`mobile-authorization`, `mobile-secure-storage`, `mobile-api-integration`, `mobile-navigation`, `../../security-review`, `../../application-documentation`.8182## Related Knowledge8384`../../../knowledge/` (auth model, trust boundaries).8586## Related References8788`../../../references/mobile/native/` when populated.8990## Context Loading Guidance9192- **Requires:** auth provider/model, API layer, secure storage.93- **Does not require:** unrelated screens, the full mobile skill set, unrelated references.94- **May load:** `mobile-secure-storage`, `mobile-api-integration`, `mobile-authorization`.95- **Stop when:** the auth plan is recorded.9697## Token Efficiency Guidance9899Plan the token lifecycle and provider; delegate storage/transport to their skills.
ahtishamshahzad