Use when adding authentication to Android applications (Kotlin/Java) with Web Auth, biometric-protected credentials, and MFA - integrates com.auth0.android:auth0 SDK for native Android apps
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Use when adding authentication to Android applications (Kotlin/Java) with Web Auth, biometric-protected credentials, and MFA - integrates com.auth0.android:auth0 SDK for native Android apps
license
Proprietary
metadata
{"author":"Auth0 <support@auth0.com>"}
Auth0 Android Integration
Add authentication to Android applications using com.auth0.android:auth0.
Agent instruction: Before providing SDK setup instructions, fetch the latest release version by running:
gh api repos/auth0/Auth0.Android/releases/latest --jq '.tag_name'
Use the returned version in all implementation dependency lines instead of any hardcoded version below. If the command fails, fall back to checking https://github.com/auth0/Auth0.Android/releases.
Prerequisites
Android API 21 or higher
Kotlin or Java project
Auth0 account with a Native application configured
See Setup Guide for automatic/manual setup, post-setup required project changes, and callback URL configuration.
Initialize: Create an Auth0 account instance:
import com.auth0.android.Auth0
val account = Auth0.getInstance(context)
Add Auth UI: Implement login and logout with Web Auth:
Agent instruction: Before adding new UI elements, search the project for existing click handlers for login, logout, sign-in, or sign-out buttons (e.g., loginButton, signInButton, logoutButton, signOutButton, or setOnClickListener with auth-related naming). If existing handlers are found, hook the Auth0 code into them without modifying the existing UI. Only create new buttons if no existing handlers are found.
Cannot resolve symbol R.string.com_auth0_scheme: strings.xml not updated — verify com_auth0_scheme, com_auth0_client_id, and com_auth0_domain entries exist
Incompatible types in callback: Callback type parameters don't match — ensure Callback<Credentials, AuthenticationException> for login and Callback<Void?, AuthenticationException> for logout
Unresolved lifecycleScope: Missing dependency — add implementation 'androidx.lifecycle:lifecycle-runtime-ktx:2.6.+' or move code out of coroutine scope
minSdk too low: SDK requires API 21+ — update minSdkVersion to at least 21
Java version mismatch: SDK requires Java 8 — add compileOptions with JavaVersion.VERSION_1_8
Re-run the build after each fix. Track the number of build-fix iterations.
Failcheck: If the build still fails after 5–6 fix attempts, stop and ask the user using AskUserQuestion:
"The build is still failing after several fix attempts. How would you like to proceed?"
Let the skill continue fixing iteratively — continue the build-fix loop for another 5–6 attempts
Fix it manually — show the remaining errors and let the user resolve them
Skip build verification — proceed without a successful build
Repeat this check after every 5–6 iterations if errors persist. Do not leave the project in a non-compiling state without the user's explicit consent.
The callback URL must match your Auth0 application settings: {SCHEME}://{YOUR_AUTH0_DOMAIN}/android/{YOUR_APP_PACKAGE_NAME}/callback
Detailed Documentation
Setup Guide — Install SDK, configure Auth0 application, set up callback URLs, Android App Links, custom schemes, ProGuard/R8
Testing & Reference — Testing checklist, common issues, security considerations, API reference
Common Mistakes
Mistake
Fix
App type not set to Native in Auth0 Dashboard
Create a Native application type in your Auth0 tenant. The Android SDK requires Native app configuration, not Machine-to-Machine or other types.
Missing callback URL in Allowed Callback URLs
Add {SCHEME}://{YOUR_AUTH0_DOMAIN}/android/{YOUR_APP_PACKAGE_NAME}/callback to your Auth0 application's Allowed Callback URLs setting, where {SCHEME} matches com_auth0_scheme in strings.xml (e.g., demo by default).
Add the INTERNET permission to AndroidManifest.xml. The SDK requires network access for authentication.
Custom scheme in lowercase
Android requires scheme names to be lowercase. Use https (recommended) or lowercase custom scheme like myapp://callback.
Forgetting .validateClaims() on direct auth calls
Always call .validateClaims() when using AuthenticationAPIClient directly (for database, passwordless, or API login). Web Auth validates automatically.
Storing tokens in SharedPreferences without encryption
Use SecureCredentialsManager to store credentials. Never store tokens manually in plain text. The manager encrypts tokens at rest.
Missing manifest placeholders
Add manifestPlaceholders = [auth0Domain: "@string/com_auth0_domain", auth0Scheme: "@string/com_auth0_scheme"] to your build.gradledefaultConfig block.
