KlugAuth

Overview

Most users give up at the registration form: a username, a password they have to remember, an e-mail code that lands in spam. With KlugAuth they tap Continue with Apple or Continue with Google and are done.

KlugAuth shows the native sign-in of each platform: Apple's sheet with Face ID / Touch ID on iOS and macOS, the Android account sheet (Credential Manager) for Google, and the system sign-in window for Google on iOS and macOS. It returns the provider's identity token together with your nonce, ready for verification on your server, plus the Apple authorization code you need to revoke the link when an account is deleted (App Store guideline 5.1.1(v)).

No Google SDK is bundled: Google sign-in on iOS and macOS uses the standard OAuth flow with PKCE in the system browser sheet, so the extension stays small.

KlugAuth runs in the next release of the PetCam App, our proof of concept, for registration, sign-in and confirming a pet-station logout with Apple or Google.

Features

• Sign in with Apple on iOS 13+, macOS 10.15+ and iPad apps on Apple silicon Macs
• Sign in with Google on Android (Credential Manager) and on iOS / macOS (system sign-in window, no Google SDK)
• Identity token, user ID, e-mail and name; Apple authorization code for refresh and revocation
• Nonce helper for replay protection (Apple carries its SHA-256, Google the raw value)
• Apple credential state check (authorized / revoked) for returning users
• Separate success, cancel and error events; cancel is reported, never an error

Supported platforms

Sign in with Apple on Android is possible with Apple's web flow and a small server page; we can provide that as part of a project. isSupported (Apple) and isGoogleSupported tell your code what the device offers.

Getting started

Add the extension to your application descriptor:

<extensions>
    <extensionID>com.klug.auth.KlugAuth</extensionID>
</extensions>

For Sign in with Apple, add the entitlement (iOS: Entitlements in the descriptor; macOS: when signing):

<key>com.apple.developer.applesignin</key>
<array><string>Default</string></array>

For Google, create OAuth clients in the Google Cloud console: a web client (its ID is the token audience on Android), an Android client with your package name and SHA-1, and an iOS client for iOS and macOS.

Quick example

import com.klug.auth.KlugAuth;
import com.klug.auth.KlugAuthEvent;

var auth:KlugAuth = KlugAuth.getInstance();
var nonce:String = KlugAuth.generateNonce();

auth.addEventListener( KlugAuthEvent.APPLE_SUCCESS, function( e:KlugAuthEvent ):void {
    sendToServer( "apple", e.identityToken, nonce, e.authorizationCode );   // verify the token on your server
});
auth.addEventListener( KlugAuthEvent.GOOGLE_SUCCESS, function( e:KlugAuthEvent ):void {
    sendToServer( "google", e.identityToken, nonce );
});
auth.addEventListener( KlugAuthEvent.APPLE_CANCELED, onCanceled );
auth.addEventListener( KlugAuthEvent.GOOGLE_ERROR, onError );   // e.errorCode / e.errorMessage

if ( auth.isSupported ) auth.signInWithApple( nonce );
else auth.signInWithGoogle( GOOGLE_CLIENT_ID, nonce );

API overview

Requirements