Authentication

Firebase gives your Android app superpowers. User authentication in minutes. Crash reports that show exactly what happened. Analytics that track user behavior. Feature flags that let you change app behavior without an update. In this tutorial, you will integrate the most important Firebase services into your Android app — Authentication, Crashlytics, Analytics, Remote Config, Cloud Messaging, and App Check. Prerequisites: You should have a working Android app with Hilt. See Android Tutorial #2: Hilt if needed. ...

Your API has registration and login with email and password. But many users prefer to sign in with their Google account. It is faster and they do not need to remember another password. In this tutorial, you will add Google Sign-In using OAuth 2.0. You will learn how the OAuth flow works, how to handle the callback, and how to link OAuth accounts with existing email accounts. How OAuth 2.0 Works OAuth 2.0 is a protocol that lets users sign in with a third-party provider (Google, GitHub, etc.) without sharing their password with your application. ...

In the previous tutorial, you added JWT authentication. Users can register, login, and access protected routes. But the implementation was basic. There were no refresh tokens, no password validation, and no logout. In this tutorial, you will build a complete authentication flow. You will add refresh tokens with rotation, strong password validation, email validation, and a logout endpoint that revokes tokens. What We Will Build Here is the complete auth flow: ...

Your API works. It has routes, a database, file uploads, and migrations. But anyone can access any endpoint. There is no authentication. In this tutorial, you will add JWT (JSON Web Token) authentication. Users will register, login, get a token, and use that token to access protected routes. How JWT Authentication Works JWT authentication follows this flow: 1. Client sends email + password → POST /api/auth/login 2. Server verifies credentials 3. Server generates a JWT token 4. Server sends token to client 5. Client stores token 6. Client sends token with every request → Authorization: Bearer <token> 7. Server verifies token and processes request The token contains encoded information (claims) about the user. The server can verify the token without a database query. ...