Native application client

This page helps you determine if a native application is the right choice for the application you are integrating with OXU Identity and how to configure guiding.

This section is part of OAuth 2.0 / OpenID Connect (OIDC) integration. Currently, the Quick Start guide and technical support for this client type are optimized for the Swift (iOS) framework.

Why am i here?

If this is your first time integrating with Oten Identity, start with:

Creating an integration app
Creating a regular web application client
Using quick start to integrate authentication into your Swift native application

What is a Native Application?

In the context of Oten Identity, a native application is an application installed directly on a user’s device, such as a mobile or desktop app.

Examples include:

iOS and Android mobile applications
Desktop applications running on user devices

Native applications cannot securely store client secrets, so they use authentication flows designed specifically for installed apps.

Choose a native application if your app:

Runs on a user’s device (mobile or desktop)
Does not have a secure backend for storing secrets
Uses system browsers or embedded web views for login

Prerequisites

Before you begin, ensure that you have:

You are now on the Create client screen.

Select Native application as the client type.

This client type is designed for mobile and desktop applications.

Confirm that the Native Application client:

Under Configure client URIs, add your redirect URIs.

Examples:

Only URIs listed here will be accepted during authentication.

https://your-app.com/callback, http://localhost:3000/callback

Click Create client to generate the Native Application client.

You will be redirected to the Client detail page.

6.1 Quick start

6.1.1 Select your technology

In the Quick Start tab, select Swift as your technology to receive tailored code samples.

6.1.2 Review prerequisites

Before you begin, ensure that you have the following:

iOS Version compatibility

This Quick Start supports:

6.1.3 Create a new iOS project

Create a new iOS project in Xcode:

6.1.4 Configure OXU IDP application

Create and configure a Native application client in the Oten Developer portal.

Redirect URI (custom URL scheme)

Configure a custom URL scheme for iOS redirect handling: yourapp://auth

The redirect URI must exactly match:

6.1.5 Add Oten authservice

Create a new Swift file named OtenAuthService.swift.

This service implements OAuth 2.0 Authorization Code Flow with PKCE using ASWebAuthenticationSession.

Responsibilities include:

Security notes

6.1.6 Configure app on launch

Update the application entry point to initialize OtenAuthService when the app launches.

This step configures the OAuth endpoints and binds the application to the Oten client created in the Developer Portal.

Provide the following values:

This configuration must be completed before any authentication action is triggered.

6.1.7 Create login UI

Create the main user interface that allows users to authenticate using Oten.

This step defines a basic login experience that includes:

The example implementation supports both:

Choose the UI framework that matches your project setup.

6.1.8 Run your app

Build and run the application using Xcode.

Sign In

Note: If the app does not return after login, verify that the Redirect URI is configured correctly in both the Oten Developer Portal and the Xcode project.

Once authentication is working:

8.1 Client credentials

The Client credentials section provides the information required to configure the SDK.

Important

For native iOS applications, authentication is handled using OAuth 2.0 with PKCE, and the client Secret is not required.

8.2 Configure client URIs

This section defines the application URLs used during authentication flows.

Redirect URIs List of allowed callback URLs where users are redirected after a successful login. Enter one or more URLs, separated by commas or new lines.

Allow origins (CORS) List of origins allowed to make cross-origin (CORS) requests to Oten Authentication APIs. This is typically required for browser-based applications.

Note:

8.3 OpenID connect

This section provides OpenID Connect–related configuration for the client.

Back-channel logout URI Server endpoint that receives logout notifications from Oten Identity. When a logout event occurs, Oten calls this endpoint to invalidate user sessions without using browser redirects.

This setting is optional and is typically used for:

If your application does not require back-channel logout, this field can be left empty.

Additional OpenID onnect settings are optional and intended for advanced integration scenarios.