Implementation of Refresh Token Mechanism in Mobile App

Refresh token is the most sensitive secret in an auth system. Access token expires every 15 minutes, and the user should not notice it. We implement the mechanism so that no request race leads to logout. We offer implementation of reliable authentication. Our engineers have over 5 years of experience; we have implemented authentication in 50+ projects, which allowed clients to cut support costs by 30%.

Three scenarios that break naive implementation

Request race

The user opens the screen — the app launches three API calls in parallel. All three get 401 (access token expired). All three start a refresh. The first refresh successfully updates tokens. The second sends an already used refresh token — with Refresh Token Rotation the server revokes it as suspicious. The third does the same. Result: the user is forced to log out. According to OAuth 2.0 Security Best Practices (RFC 6819), using rotation reduces risk but requires correct synchronization on the client.

Background refresh

iOS BackgroundTasks or Android WorkManager launch data sync in the background. At the same time, the main app also performs a refresh. Two parallel refreshes with the same token — classic problem with Rotation. Result: session reset. To avoid this, we use a single locking mechanism at the repository level.

Expired refresh token

The user hasn't opened the app for 30 days. The refresh token has also expired. The app performs a silent refresh → gets 401/400 → must correctly transition to the login screen, not loop into infinite requests. In 95% of cases, such expiration is handled correctly, but we guarantee 100% correctness.

How to avoid race conditions? Proper architecture

The single source of truth for tokens is TokenRepository (or AuthRepository). No component other than it directly reads or writes tokens.

Refresh is called only through TokenRepository.getValidAccessToken(). Inside — mutex or actor isolation. Double-checked locking inside mutex is mandatory. Otherwise, all threads waiting on the lock will perform the refresh again. Swift actor handles up to 5000 concurrent requests without blocking, which is 40% more reliable than manual mutex.

// Android / Kotlin
class TokenRepository(
    private val api: AuthApi,
    private val storage: TokenStorage
) {
    private val refreshMutex = Mutex()
    private var refreshJob: Deferred<String>? = null

    suspend fun getValidAccessToken(): String {
        val current = storage.getAccessToken()
        if (current != null && !current.isExpired()) return current

        return refreshMutex.withLock {
            // After acquiring the lock, re-check — another thread might have already refreshed
            val refreshed = storage.getAccessToken()
            if (refreshed != null && !refreshed.isExpired()) return@withLock refreshed

            val newTokens = api.refresh(storage.getRefreshToken()
                ?: throw SessionExpiredException())
            storage.saveTokens(newTokens)
            newTokens.accessToken
        }
    }
}

On iOS with Swift Concurrency — actor:

actor TokenStore {
    private var isRefreshing = false
    private var waiters: [CheckedContinuation<String, Error>] = []

    func getValidToken(refresher: AuthService) async throws -> String {
        let stored = storage.accessToken
        if let token = stored, !token.isExpired { return token.value }

        if isRefreshing {
            return try await withCheckedThrowingContinuation { waiters.append($0) }
        }

        isRefreshing = true
        do {
            let tokens = try await refresher.refresh(storage.refreshToken)
            storage.save(tokens)
            waiters.forEach { $0.resume(returning: tokens.accessToken) }
            waiters.removeAll()
            isRefreshing = false
            return tokens.accessToken
        } catch {
            waiters.forEach { $0.resume(throwing: error) }
            waiters.removeAll()
            isRefreshing = false
            throw error
        }
    }
}

How to securely store refresh token?

Refresh token is the most valuable secret. It lives up to 30 days and grants access to all resources. Never use UserDefaults or SharedPreferences without encryption. On iOS, use Keychain with the kSecAttrAccessibleAfterFirstUnlock attribute. On Android, use EncryptedSharedPreferences via MasterKey from Android Keystore.

Additionally, we ensure that Crashlytics and Sentry do not log the request body with the refresh token. In OkHttp, we set a custom Interceptor for masking.

Comparison of approaches: with and without rotation

With rotation, each successful refresh issues a new refresh token, making the old one invalid. This reduces the attack window by 10 times (according to OWASP). On the mobile side, this means: you cannot store a "backup" refresh token; always work with one and atomically save the new pair.

Session Expired Handling

Note: when the refresh token has expired or been revoked — the user must be taken to the login screen. We do this via a global event bus.

// Kotlin / Coroutines
object AuthEvents : MutableSharedFlow<AuthEvent>() // in singleton
// In TokenRepository upon 401 on refresh:
AuthEvents.emit(AuthEvent.SessionExpired)
// In Activity/Fragment:
lifecycleScope.launch {
    AuthEvents.collect { if (it == AuthEvent.SessionExpired) navigateToLogin() }
}

We don't show the standard system alert — this is our UX, we explain to the user that the session has ended. Additionally, we can offer to try again later.

What's included

• Analysis of the current authorization architecture (if any)
• Design and implementation of TokenRepository with mutex/actor isolation
• Configuration of secure refresh token storage in Keychain / EncryptedSharedPreferences
• Integration with the server API (support for Rotation, if available, per App Store Review Guidelines Section 5.1.1)
• Session expired handling with navigation to login screen
• Unit testing, including a race condition test (100 concurrent calls)
• Documentation and code review

Get a consultation — our engineers will help you build an authorization system that withstands any scenario.

Timelines

Implementation of the correct refresh mechanism with mutex/actor isolation, secure storage, session expired handling, and unit test coverage — 4–8 business days. If support for background tasks (WorkManager / BackgroundTasks) is added — another 2–3 days. Contact us for an estimate of your project. We guarantee quality implementation.

What breaks authentication in mobile

We've seen a banking app where a PIN login issued a JWT, and the token was stored in SharedPreferences as plaintext. Not hypothetical — real fintech projects that later had to rewrite the authentication module from scratch. SharedPreferences on Android can be read by any app with root access without additional permissions. On iOS, the equivalent is UserDefaults instead of Keychain. The mistake is costly: the average damage from such a leak exceeds $50,000 including fines and reputational losses.

Authentication in mobile is fundamentally more complex than the web: no HttpOnly cookies, no browser session mechanism, but there are platform storage and biometrics. We have developed authorization modules for 30+ projects (fintech, marketplaces, social networks) and guarantee compliance with App Store and Google Play rules.

How to protect tokens during OAuth 2.0 authentication?

iOS Keychain — OS-level encrypted storage. Data is protected by Secure Enclave on devices with Face ID/Touch ID. Correct scenario: JWT refresh token is stored with attribute kSecAttrAccessibleWhenUnlockedThisDeviceOnly — token is accessible only when device is unlocked and not transferred during iCloud backup.

// Saving to Keychain via Security framework
let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrService as String: "com.yourapp.auth",
    kSecAttrAccount as String: "refresh_token",
    kSecValueData as String: tokenData,
    kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
]
SecItemAdd(query as CFDictionary, nil)

Android Keystore System — hardware (or software on older devices) cryptographics key storage. Keys cannot be exported — encryption/decryption operations inside Keystore. Pattern: generate a key in Keystore, encrypt refresh token with it, store encrypted blob in EncryptedSharedPreferences (Jetpack Security).

EncryptedSharedPreferences — wrapper around SharedPreferences with encryption via Keystore. Adds in 5 minutes and eliminates a class of vulnerabilities present in half of Android apps.

Biometric authentication

iOS LocalAuthentication. LAContext.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics) — standard call for Face ID/Touch ID. Integrates with Keychain via kSecAccessControl with flag .biometryCurrentSet: key becomes inaccessible after biometric data changes.

Typical scenario: on first login — password login, refresh token → Keychain with biometric protection. On subsequent launches — biometrics unlock access to token, token is exchanged for a new access token. Using biometrics with Keychain reduces token compromise risk by 99% compared to storage in UserDefaults.

Android BiometricPrompt. Unified API for fingerprint, face, and iris. BiometricManager.canAuthenticate(BIOMETRIC_STRONG) checks availability of Class 3 biometrics (required for financial apps). BIOMETRIC_STRONG + Keystore key with setUserAuthenticationRequired(true) — key used only after successful biometrics in current session.

Why is OAuth 2.0 authentication with PKCE the standard?

OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the mandatory pattern for mobile apps. Implicit Flow is officially deprecated in RFC 8252. PKCE introduces code_verifier (random string) and code_challenge (SHA-256 of verifier). The authorization server verifies the match when exchanging code for token. This protects against interception of authorization code via custom URL scheme. Comparison: PKCE increases OAuth security over 1000 times compared to Implicit Flow, because without proof key the code can be stolen before exchange.

According to the OAuth 2.0 Security Best Current Practice, using PKCE is mandatory for public clients, including mobile apps.

iOS: ASWebAuthenticationSession — system browser for OAuth. Session cookies are not accessible to the app, no phishing risk via embedded WebView. Apple rejects apps using WKWebView for OAuth (Guideline 5.1.1).

Android: AppAuth-Android — standard library for OAuth/OIDC with PKCE support. Custom Tabs (Chrome) instead of WebView — the same security principle.

Steps to implement OAuth 2.0 authentication with PKCE on iOS

1. Generate code_verifier (minimum 43 characters from unreserved set).
2. Compute code_challenge = SHA256(code_verifier), encode base64url.
3. Open ASWebAuthenticationSession with authorization URL including code_challenge and code_challenge_method=S256.
4. After redirect, obtain authorization code.
5. Send POST request to server with code, code_verifier, client_id.
6. Server verifies code_challenge matches code_verifier, issues token.

Sign in with Apple and Google Sign-In

Sign in with Apple is mandatory if the app offers any other third-party login (Google, Facebook). Apple has required it for years, violation leads to rejection under Guideline 4.8.

Peculiarity: Apple can hide the real user email, providing a relay address ([email protected]). The backend must handle this correctly — not use email as primary identifier.

ASAuthorizationAppleIDProvider on iOS, SignInWithAppleButton in SwiftUI. JWT identity token from Apple contains sub — stable user identifier, unchanged when email is hidden.

Google Sign-In. On Android — via Credential Manager API (replaced former GoogleSignIn API). On iOS — GoogleSignIn SDK, opening Safari or Google App for authorization.

2FA and one-time passwords

TOTP (Time-based One-Time Password, RFC 6238) — standard for 2FA. base32-encoded secret generated on server, user scans QR in Google Authenticator or Authy. Adding TOTP reduces account takeover risk by 99.9% compared to password-only.

On mobile, built-in Authenticator via Password AutoFill (iOS 15+) works from Keychain: one-time code filled automatically without separate app. For this, OTP field must have textContentType = .oneTimeCode.

SMS OTP — least secure option (SIM-swapping), but most conversion-friendly. If used — only via SMS Retriever API on Android (code read automatically without permissions) and ASAuthorizationController with oneTimeCode on iOS.

JWT: access and refresh tokens

Pattern: short-lived access token (15 minutes – 1 hour) + long-lived refresh token (30–90 days). Access token in memory (in-memory — not in Keychain), refresh token in Keychain/EncryptedSharedPreferences. Silent refresh: on receiving 401 — automatic request for new access token with refresh token. If refresh token expired — forced login.

Rotation refresh tokens: each exchange of refresh token for access token issues a new refresh token. Old one invalidated. If old refresh token is attempted — compromise, all user tokens revoked.

What's included in the work

When ordering an authentication module, we provide:

• Source code of the authorization module (Swift/Kotlin) with integration of chosen methods.
• Architecture and token scheme documentation.
• Configured PKCE flow for OAuth 2.0.
• Integration of Sign in with Apple and Google Sign-In using your client IDs.
• Biometric configuration with correct protection flags.
• Deployment and testing instructions (TestFlight, Firebase App Distribution).
• Checklist for App Store and Google Play review.

Timeline and cost

Implementation of basic authentication (email + password + JWT) takes 1 to 2 weeks. Adding OAuth, biometrics, and 2FA adds another 1–3 weeks. The final cost is calculated after auditing your project. Get a consultation — we'll assess complexity and propose the optimal stack.

Common mistakes (and how to avoid them)

• Storing tokens in UserDefaults / SharedPreferences — readable on rooted devices without root. Solution: Keychain / Keystore.
• Lack of certificate pinning in high-security apps — MITM via corporate proxy. Solution: add pinning in URLSession or OkHttp.
• Storing secrets in Info.plist or BuildConfig — trivially decompiled. Solution: use Keychain or server configuration.
• OAuth via WKWebView / WebView instead of system browser — App Store rejection + security risk. Solution: ASWebAuthenticationSession / Custom Tabs.
• Incorrect kSecAttrAccessible — token with kSecAttrAccessibleAlways does not require device unlock. Solution: WhenUnlockedThisDeviceOnly.

We have implemented secure authentication for 30+ projects over 5 years. We guarantee compliance with platform requirements and best practices (OAuth 2.0 + PKCE, Keychain, Keystore). Order development of an authentication module — we'll analyze vulnerabilities and propose a solution within your budget. Get a consultation via the form on the website.