title: Best Practice Authentication / Authorization Native Mobile App
body: <p>Currently we are looking into the development of a mobile app (native) and we would like to login the customer to the backend (Java) which has a REST API using a 5 digit code, their fingerprint or face ID only. Now did I read the RFC 8252 (<a href="https://www.rfc-editor.org/rfc/rfc8252" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc8252</a>) which stated that this is the best authorization method for native mobile apps, but I was wondering how the authentication step should work in this case. Of course I already found a few topics on stackoverflow but most of them are quite old and probably outdated (?), e.g. <a href="https://stackoverflow.com/questions/21588781/rails-api-and-native-mobile-app-authentication">Rails api and native mobile app authentication</a></p>
  <p>I expect that it should work as follow, but not sure if that is correct. When the customer register in the mobile app, we should generate a token (UUID) in the backend and store this in the database in the keychain of the mobile app which can only be accessed by entering the PIN or biometrics. When the customers authenticate their self via either the PIN of biometrics we could grap the token and sent this to the backend to verify if it is valid. Only I have a few concerns about this approach:</p>
  <ul>
  <li><p>As we will only authenticate the customer based on the token this would mean that if you can grap the token, you can login on each device. To avoid this we could store the device ID or another ID that makes the device unique, although from a GDPR perspective it's not ideal to store the Device ID as you can identify the customer based on this ID.</p>
  </li>
  <li><p>If the customer will root the device they have access to the keychain and thus the could grap/steal the token</p>
  </li>
  </ul>
  <p>So as you understand I'm not sure if this is the most save approach and I was wondering if there are better practices to create an authentication/authorization flow for a native mobile app, e.g. how are mobile bank apps doing their authentication/authorization flow?</p>
  <p>Thank you</p>