Sign-In and Security Done Right: Credential Manager, Passkeys, Sign in with Google, Biometrics, the Keystore, Network Security and Play Integrity for Android Apps

Sign-In and Security Done Right is a practical guide to the parts of an Android app that attackers actually go after: the sign-in screen, the secrets on the phone, the session that keeps a user signed in, the traffic on the wire, the components other apps can reach, and the API your server trusts. It starts from a threat model sized for a small app (a lost phone, phishing and reused passwords, a hostile network, other apps on the device, leaked tokens, scripts and repackaged APKs) and uses OWASP MASVS v2.1.0 as the reference checklist throughout. You replace the legacy Google sign-in APIs with Credential Manager and Digital Asset Links, ship passkeys end to end with real server verification (SimpleWebAuthn, with java-webauthn-server named for the JVM) and the android:apk-key-hash origin, add Sign in with Google with a nonce and server-side ID token checks, make a biometric prompt unlock a real Keystore key through a CryptoObject, store tokens with AES-GCM keys in the Android Keystore and the new DataStore Tink serializer, design sessions with short access tokens, rotating refresh tokens and reuse detection, refresh them once with an OkHttp Authenticator, keep billed API keys out of the APK, configure the network security config (debug-only user CAs, pinning trade-offs, Certificate Transparency on Android 16 and 17, Encrypted Client Hello), audit exported components, PendingIntents, WebViews, overlays and backups, and protect valuable endpoints with Play Integrity standard requests and a response policy that does not punish honest users. Everything is applied to a small notes app, Field Notes, as one reviewed security module. Every library version, API level and default was checked against the official Android Developers pages, Google's identity and Play documentation, OWASP and the projects' own releases in October 2026. No prices, anecdotes or unsourced numbers.

What you get

• Before We Start: a threat model for a small app, what Android already gives you, and OWASP MASVS v2.1.0 as the reference checklist
• Credential Manager and Digital Asset Links: what happened to Smart Lock, One Tap and Google Sign-In for Android, saving and getting passwords, one sheet for every credential, and assetlinks.json served correctly
• Passkeys, from the app to the server: WebAuthn in one figure, registration and sign-in options, CreatePublicKeyCredentialRequest and GetPublicKeyCredentialOption, failure handling, server verification with SimpleWebAuthn, the android:apk-key-hash origin, Restore Credentials and testing
• Sign in with Google: GetGoogleIdOption vs GetSignInWithGoogleOption, the web client ID, the nonce, verifying the ID token on the server, linking accounts safely, and migrating from GoogleSignInClient
• Biometrics that actually protect something: BIOMETRIC_STRONG vs BIOMETRIC_WEAK vs DEVICE_CREDENTIAL by Android version, canAuthenticate, and a CryptoObject bound to an authentication-required Keystore key
• The Android Keystore: AES-GCM keys for tokens, user-authentication parameters, invalidation, StrongBox with its fallback, key attestation in one section, and replacing EncryptedSharedPreferences with DataStore and Tink
• Tokens and sessions: access vs refresh tokens, rotation with reuse detection, an OkHttp Authenticator that refreshes once, sign out everywhere, and why secrets do not belong in the APK
• Network security: the network security config, debug-only proxies, when (not) to pin and how, Certificate Transparency on Android 16 and 17, and Encrypted Client Hello
• Hardening the app: R8 and logs, the exported components audit, deep links and intent redirection, PendingIntent mutability, WebView settings, FLAG_SECURE, tapjacking, clipboard and backup rules
• The Play Integrity API: standard vs classic requests, requestHash, decoding on the server, every verdict field, tiered enforcement and remediation dialogs
• Putting it together: the Field Notes :core:auth module, its tests, and a control-by-control MASVS map, plus a MASVS-tagged security checklist and a cheat sheet

75 pages, 25 diagrams plus a chapter-opener graphic for every chapter, a MASVS-tagged security checklist and a cheat sheet. PDF and EPUB. Android the Right Way, Book 9.

Not sure yet? Read the free sample first: the cover, the full table of contents and all of Chapter 2, "Passkeys, from the App to the Server" (WebAuthn in one figure, what you need before you start, server-generated registration options, creating the passkey with CreatePublicKeyCredentialRequest, handling creation failures, verifying and storing the credential with SimpleWebAuthn, the android:apk-key-hash origin, signing in with GetPublicKeyCredentialOption and server verification, offering and managing passkeys, Restore Credentials, and testing), at https://payhip.com/b/01OcP

Also in a bundle: Everything Bundle: every ebook in the store, $89 · Android Bundle, $49.