Authentication
Account email authentication, native social credentials, and shared session state.
Supported flows
Authentication belongs to the Account profile. The template includes email/password login and registration, email verification/resend, forgot/reset password, logout, profile editing, connected accounts, password change, session management, login history, and account deletion.
The current native login UI uses Google on Android and Apple on iOS. Connected-account management supports Google and Apple; initiating an Apple connection is iOS-only, while an existing Apple connection can be disconnected on Android. Do not assume the Flutter social-login buttons are identical to KMP.
Session lifecycle
AuthStore exposes shared session state through StateFlow. AuthRepository saves bearer tokens through secure storage and sends them to the Account backend. Startup can restore cached user state before server validation; rejected sessions are cleared, while transport failures retain the cached session. Laravel owns token issuance; see Backend Architecture.
Guest startup creates a local guest user and skips Account authentication and validation requests. See Guest mode.
Native credentials
Configure identifiers after renaming the app. Paths are relative to mobile-app/.
| Platform | Configuration |
|---|---|
| Android Google | GOOGLE_SERVER_CLIENT_ID in local.properties; matching androidApp/google-services.json can supply the web client ID when no explicit value is set. Register package and signing fingerprints in Firebase. |
| iOS Google connected account | GOOGLE_IOS_CLIENT_ID, GOOGLE_SERVER_CLIENT_ID, GOOGLE_IOS_REVERSED_CLIENT_ID in iosApp/Configuration/Config.local.xcconfig. iosApp/iosApp/Info.plist registers the reversed client scheme. |
| iOS Apple | Enable Sign in with Apple for the final bundle ID and signing profile. iosApp/iosApp/iosApp.entitlements contains the capability. |
The Google server client ID must match the audience accepted by your backend. Native credential gateways return ID tokens to the shared API flow. Follow the generated mobile-app/ACCOUNT-CREDENTIALS.md for detailed Google/Apple setup.
Source map and validation
Shared authentication files live under sharedLogic/src/commonMain/kotlin/com/soewidiputra/kmponlate/: AuthEndpoints.kt, AuthRepository.kt, AuthStore.kt, LoginFormStore.kt, RegisterFormStore.kt, and ConnectedAccountsStore.kt. AuthFeatures.kt defines the social-login, forgot-password, and registration-link switches.
Test login, registration, verification, reset links, social cancellation, logout, expired sessions, and offline relaunch on both platforms. Deep Links explains how reset credentials reach the reset form.