Hi everybody Let s see if you can help me with this setup He

Question

Hi everybody Let s see if you can help me with this setup Here s the thing I want to provide my users the ability to login register etc using a Identity Provider implemented via Kratos when they access some webapps I maintain with domains such as or and also when they use native apps also maintained by me in their phones AFAIK Kratos must be running in the same top level domain as the clients trying to use it So if my Kratos is running at at all these webapps running under domain can use is without problems The thing is How can I make the users of native apps to use my Kratos instance Other restrictions I have on this environment are I cannot use OAuth2 flows therefore using Hydra as OAuth2 provider that uses Kratos as Identity Provider is not a possibility No possibility for poping up a browser login registration flows must occur within the app

hundreds-train-83112 · Answer

I guess that I can use the <https www ory sh docs kratos self service api flows|API Flow> on these native apps for iOS Android etc but this warning is preventing me from using it ```Never use API flows to implement Browser applications Using API flows in Single Page Apps as well as server side apps opens up several potential attack vectors including Login and other CSRF attacks ```

damp-sunset-69236 · Answer

Hello < U03DWMBQQNL> Yep API flow is what you need to solve your issue

damp-sunset-69236 · Answer

We have this warning to prevent users use API flows to implement login registration flows for browser only But in your case that s the only option

damp-sunset-69236 · Answer

To make it easier to understand cookies gt browsers tokens gt native mobile apps and better not mix it like tokens gt browsers and native mobile apps

hundreds-train-83112 · Answer

Thanks so much for the information < U02U9MSKL9X>

hundreds-train-83112 · Answer

Are there any security concerns of using tokens vs cookies

damp-sunset-69236 · Answer

<http cryto net ~joepie91 blog 2016 06 13 stop using jwt for sessions |This article> explains almost everything you need to know about it

hundreds-train-83112 · Answer

Thanks

damp-sunset-69236 · Answer

BTW is an example of how to use API flows For your case I think that you need to use browser flows for browser is a great example of how to use them For mobile apps you need to use API flows and ory cli can be used as reference

hundreds-train-83112 · Answer

Awesome I ve already tried the self service ui and it works smoothly

hundreds-train-83112 · Answer

I ll give it a try to the Ory CLI now

damp-sunset-69236 · Answer

FYI Ory cli is a tool that manages ory cloud instances slightly smiling face

damp-sunset-69236 · Answer

We don t have examples for native mobile apps yet unfortunately