Flutter (flutter_appauth)

Use a public client with PKCE. Drive the flow with flutter_appauth.

Pick your path: Follow the guide below, or jump to the AI prompt.

Follow the guide

A — Login vs enrol

• Login: call FlutterAppAuth.authorizeAndExchangeCode(...) as usual → /authorize.
• Enrol: add prompt=create via the request's additionalParameters → /authorize?prompt=create.

Choose one of:

• Option 1 (recommended): "Sign in" and "Create account" buttons, the latter passing additionalParameters: {'prompt': 'create'}.
• Option 2: attempt login; on error=access_denied + error_description=user_not_registered, retry with prompt=create.

B — Redirect callback setup

• Register redirectUrl as a custom URL scheme (e.g. com.yourapp://callback). EntryIdP does not host apple-app-site-association or assetlinks.json, so Universal Links / App Links are not available.
• iOS: add the scheme to Info.plist under CFBundleURLTypes.
• Android: add the scheme to AndroidManifest.xml. flutter_appauth contributes its redirect activity, but you must declare your scheme in the manifest (commonly via the appAuthRedirectScheme manifest placeholder).

C — Secure token storage

Token	Where
Access token	flutter_secure_storage.
Refresh token	Same store.

Use an AI prompt

Add EntryIdP biometric OIDC login to this Flutter app using flutter_appauth.

EntryIdP is an OpenID Connect provider. Users authenticate ONLY with a face liveness
check — no typed credentials, OTPs, or social logins. Do not build any sign-in form or credential-entry UI.
Issuer: https://idp-test.entryidp.com (use the issuer from my client registration; read
from config — never hardcode).

Before writing code:
1. Add flutter_appauth and flutter_secure_storage to pubspec.yaml if missing.
2. Open Info.plist (iOS) and AndroidManifest.xml / build.gradle (Android) to register the
   redirect scheme.

Implementation:
- Authorization Code + PKCE only (flutter_appauth adds PKCE with S256). Never implicit
  flow or response_type=token.
- PUBLIC client: no client_secret anywhere.
- Use FlutterAppAuth.authorizeAndExchangeCode with issuer discovery (discoveryUrl =
  {issuer}/.well-known/openid-configuration). Do not hardcode endpoints.
- Redirect URI is a CUSTOM URL SCHEME (e.g. com.yourapp://callback). iOS: CFBundleURLTypes
  in Info.plist. Android: set the appAuthRedirectScheme manifest placeholder and declare
  the scheme. EntryIdP does NOT support Universal Links / App Links.
- Store tokens with flutter_secure_storage. Never shared_preferences.

Login vs enrol (EntryIdP-specific):
- "Sign in" → standard authorize call (login of an existing face).
- "Create account" → additionalParameters: {'prompt': 'create'} (first-time face
  enrolment).
- On error=access_denied with error_description=user_not_registered, retry with
  prompt=create.

Guardrails:
- No sign-in form, OTP, or social-login UI.
- No client_secret.
- Custom URL scheme redirect only; no Universal Links / App Links.
- No implicit flow; endpoints from discovery, not hardcoded.

---

Done? Run through the pre-launch checklist before you ship, and see Refresh tokens rotate if you requested offline_access.