quick poll, do you store access/refresh tokens in ...

# android-architecture

[ursus]

quick poll, do you store access/refresh tokens in shared prefs or sqlite?

[Will Shelor]

(Previous answer was wrong. See longer answer below 🙂 )

[Joost Klitsie]

If you want your token stolen I guess you can use both 😄

[Joost Klitsie]

I would use the new security library for that

[Joost Klitsie]

https://developer.android.com/topic/security/data

[Joost Klitsie]

anyway if you would use shared prefs make sure you make it async (as you are doing disk i/o)

[Joost Klitsie]

maybe jetpack datastore is interesting: https://developer.android.com/topic/libraries/architecture/datastore

[streetsofboston]

Store them in encrypted shared prefs.
And, depending on our client, guarded by a biometric prompt.

[Bhaskar]

I would say use shared pref for faster access compared to sqlite. Plus as per your requirement your value looks like key-value pair, which will keep on getting updated. For adding security use encryption before saving.

[ursus]

I have it in shared prefs too, but contemplating putting in sqlite, since I alraedy have it for actual data .. and would get transactions, migrations etc ..not worth it?

[Will Shelor]

… actually, I dug into this a bit, and turns out we’re using the AccountManager. We’re not storing the tokens ourselves- we’re letting them be managed by Google, connected to the account we create for the user as part of onboarding.

[ursus]

im not really fan of that, unless you have multiple apps using the same account; since that will survive app uninstall