# Mobile App AuthN/AuthZ against a Pomerium protected resource

**URL:** <https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240>\
**Category:** Integrations\
**Created:** [February 21, 2023, 4:42pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240 "2023-02-21T16:42:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kking-biometrica](https://avatars.discourse-cdn.com/v4/letter/k/b4bc9f/32.png) [@kking-biometrica](https://discuss.pomerium.com/u/kking-biometrica)\
**Post date:** [February 21, 2023, 4:42pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240/1 "2023-02-21T16:42:00Z")

</div>

We are trying to grant access to an existing resource protected by Pomerium Enterprise so that a Mobile application (iOS, Android) can access the resource. What is the best approach to allow users who already have web-based access to the resource to also be able to use the mobile application with the resource?

It looks as though this is a candidate for utilizing API based authentication [https://www.pomerium.com/docs/capabilities/programmatic-access](https://www.pomerium.com/docs/capabilities/programmatic-access). Would this be the best approach?

---

<div class="post-metadata">

**Author:** ![denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@denis](https://discuss.pomerium.com/u/denis)\
**Post date:** [February 21, 2023, 6:28pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240/2 "2023-02-21T18:28:29Z")

</div>

Yes, currently you should be able to do that using programmatic login workflow.

1. user starts an application and requires access to the resources protected by Pomerium
2. an application starts a local web server on some random port, i.e. `http://localhost:8888` - there are packages for iOS and Android ecosystem, look for the _embedded web server_. It needs implement a [callback handler](https://www.pomerium.com/docs/capabilities/programmatic-access#callback-handler) that would obtain the authorization JWT.
3. an application creates a web view control with URL to the destination route - i.e. `https://my-route.my-domain.com/.pomerium/api/v1/login?pomerium_redirect_uri=http://localhost:8888`.
4. When the programmatic login completes, the embedded web server handler would obtain the JWT, and may close the browser window control at that point.
5. Now that JWT may be used by the mobile application while invoking a calls to the protected resource (`https://my-route.my-domain.com`), until the JWT expires (which should match the Pomerium session max validity period), and reflected in the JWT `exp` field. When JWT is no longer valid, an application should pause the normal work and repeat the authentication flow described above.

---

<div class="post-metadata">

**Author:** ![kking-biometrica](https://avatars.discourse-cdn.com/v4/letter/k/b4bc9f/32.png) [@kking-biometrica](https://discuss.pomerium.com/u/kking-biometrica)\
**Post date:** [February 21, 2023, 7:58pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240/3 "2023-02-21T19:58:15Z")

</div>

Does this work with custom protocol handlers? i.e. if we want the callback uri to be `my+custom+app://callback`, can we register that in the whitelist, or are only http and https supported?

---

<div class="post-metadata">

**Author:** ![denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@denis](https://discuss.pomerium.com/u/denis)\
**Post date:** [February 21, 2023, 8:10pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240/4 "2023-02-21T20:10:51Z")

</div>

custom URL schemes are generally deprecated and replaced with universal links across iOS and Android. see [Apple Developer Documentation](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app)

I personally wouldn’t recommend going this way (including binding universal link with your app), as it’ll create a recurrent dependency with the above described scenario.

---

<div class="post-metadata">

**Author:** ![kking-biometrica](https://avatars.discourse-cdn.com/v4/letter/k/b4bc9f/32.png) [@kking-biometrica](https://discuss.pomerium.com/u/kking-biometrica)\
**Post date:** [February 21, 2023, 8:39pm UTC](https://discuss.pomerium.com/t/mobile-app-authn-authz-against-a-pomerium-protected-resource/240/5 "2023-02-21T20:39:25Z")

</div>

Understood. We will go the Universal/App Links route since that is now best practice.