public final class SecureStorageTokenStore

A TokenStore that keeps an OidcClient’s tokens in the platform’s secure storage – the iOS keychain, the Android keystore, and what each desktop and browser port provides – instead of the application’s ordinary Storage.

client.setTokenStore(new SecureStorageTokenStore());

A refresh token is a long-lived credential: whoever reads it can keep a session alive without the user. That is the reason to prefer this store over the default one for any application that signs in to something that matters.

Quiet and gated

By default the store uses the non-prompting half of SecureStorage: entries are encrypted by the operating system and read without asking the user, which is what a token attached to every request needs. requireBiometrics(String) switches to the gated half, where reading (and on Android writing) shows a biometric prompt. An application that does this should load its tokens once, when it starts, and keep them in memory – OidcRequestAuthorizer does. Loading prompts only when this store saved something to read: before the first sign-in, and after clear(String), it completes with null without asking the user anything.

A platform with no secure storage

Nothing is downgraded silently. On a port with no secure storage every operation fails with an OidcException whose code is OidcException.STORAGE_UNAVAILABLE, so the application finds out the first time it runs there rather than discovering later where its refresh tokens went. allowPlainStorageFallback(boolean) is the explicit opt-in: with it, such a platform gets TokenStore.DefaultStorageTokenStore instead. The fallback is only used where secure storage cannot be reached at all, never because one write failed.

Both stores write the same document, so an entry can be copied from one to the other as is.