Question: Where to store access tokens?

[tafelnl]

This may be a little out of scope for this package, but I think it might be important to formulate a best practice for this. So that every developers handles it the same and we can discuss privacy/security issues for the implementation.

Access tokens can be stored in a cookie, localstorage or key vault for example. When a fetch is made, somehow these access tokens should be sent with it. What do you think is the best practice to handle this?

[JHurley-BD]

I agree @tafelnl

Im aware that issues are not meant for support topics but as mentioned above i do think it would be useful if we could have somewhere to discuss topics like this.

Stack-overflow yields no results. As a newbie to native development would be good to hear some success stories using this plugin

[RaphaelWoude]

You can use the capactior-secure-storage plugin for this.
This plugin stores data in secure locations for natives devices.

• For Android it will store data in a AndroidKeyStore and a SharedPreferences.
• For iOS it will store data in a SwiftKeychainWrapper.

[moberwasserlechner]

I will add @RaphaelWoude answer to the Readme.

If anyone would like to share her/his experiences it would be most appreciated.

[moberwasserlechner]

https://github.com/moberwasserlechner/capacitor-oauth2#where-to-store-access-tokens