Android: Authorization

View on Github

Android: Authorization

Gravatar for
By Luciano Balmaceda

This tutorial will show you how to use the Auth0 authentication API in your Android project to create a custom login screen. We recommend you to Log in to follow this quickstart with examples configured for your account.

I want to explore a sample app

2 minutes

Get a sample configured with your account settings or check it out on Github.

View on Github
System requirements: Android Studio 2.3 | Android SDK 25 | Emulator - Nexus 5X - Android 6.0

This tutorial shows you how to use Auth0 to create access roles for your users. With access roles, you can authorize or deny access to your content to different users based on the level of access they have.

Universal login and login pages

Child Tenant Policy

1. Set up your app in Facebook

How it works

Initiate a Silent Authentication request

Configure Auth0

Keep Reading

Types of JWT Claims


Use JSON Web Tokens (JWT) with client-side applications


Performance Testing

Provided languages

Keep reading


Keep reading

1. Set up your app in Facebook

Configure Auth0 APIs

Who is this guide for?

Why use Auth0?

Step-by-step guide

Keep reading

User profile attributes


How it works

Risks of using an IdP-Initiated SSO flow


Identity Tokens

Opaque Access Tokens

End user experience

Identity Tokens


Regular web apps

Configure the extension

Metadata Best Practices

Keep reading

Search for users using the Management API

Keep reading

Project Planning Guide


Install the Extension

Read more

US Region

Issue: The IdP Login Page Doesn't Display

1. Create a Code Verifier

Configure Auth0

Configure Auth0

Identity Tokens

Searchable fields

Configure Auth0

Step 1: Create an API and Machine to Machine Application

What's changed?

How Passwordless works

Before You Start

Be sure that you have completed the Login quickstart.

Create a rule that assigns the users either an admin role, or a simple user role. Go to the new rule page and select the "Set Roles To A User" template, under Access Control. Replace the default script contents with the following snippet:

The default rules for assigning access roles are:

  • If the user's email contains, the user gets the admin role.
  • If the email contains anything else, the user gets the regular user role.

The rule can be customized to grant the user different roles other than the ones explained here, depending on the conditions required in a project. There is a restriction on the name of the claims added to the ID Token which must be namespaced. Read this article for more context about Rules.

Branding login by organization

Request a Child Tenant

2. Create and enable a connection in Auth0

Device Flow

Successful authentication response

Get Your Application Keys

Reserved claims


Use sessions with server-side applications

Get Access Tokens Manually

The Auth0 Dashboard

Set language option


2. Create and enable a connection in Auth0

Create an API


Which industry standards does Auth0 use?

1. Create a new application

View user profile

Get Access Tokens

How to implement it

On IdP-Initiated flows and OpenID Connect


Access Tokens

JSON Web Token (JWT) Access Tokens

Administrative setup

Access Tokens

Restrictions on Refresh Token Usage

Native/mobile apps



Search using the API Explorer

Multiple Organization Architecture (Multitenancy)

Restrictions on Refresh Token Usage

Use the Extension

EU & AU Regions

Test the Connection

2. Create a Code Challenge

Get Your Application Keys

Get Your Application Keys

Access Tokens

Field name examples

Get Your Application Keys

Step 2: Create a Connection

Step 1: Request the code

Test the Rule in Your Project

Once the user credentials had been obtained (as explained in the Login tutorial), save them to access them at any time.

The claims added to the ID Token via a Rule are included in the userinfo endpoint response. Use the Access Token to call this endpoint and obtain the user roles.

Custom domain naming

Alter Your Tenant's Subscription Plan

3. Test the connection

Browser Flow

Error response

Configure Callback URLs

Custom claims

Authorize the User

Use local domains with Auth0

Use Access Tokens for Testing

Third-Party Testing Tools

Replace dictionary terms


3. Test the connection

Define Permissions

My application works just fine, why should I update?

Keep reading

2. Configure the permissions

Keep reading

Use Auth0's Node.js Client Library

Keep reading

How to set up IDP-initiated SSO

Install With Composer

How not to use tokens

Auth0 Management API Access Tokens

How not to use tokens

Get a Refresh Token

Single-page apps

Deploy Database Connection scripts

Auth0 APIs

Search using Postman

Get started

Get a Refresh Token

Import Users

Check the Connection's Settings

3. Get the User's Authorization

Configure Callback URLs

Configure Callback URLs

How not to use tokens


Configure Callback URLs

Enable the Connection for Your Application

Step 2: Input the code

Restrict Content Based On Access Level

Roles can be used to distinguish user permissions within an app, authorizing or denying access to a certain feature. The sample project illustrates this by allowing users with the admin role to access the "Settings Activity".

Use Auth0 for FREE