Skip to main content
Skip to navigation

Authentication

How RevenueCat verifies the identity of your Customers

AIAsk AIChatGPTClaude

Authentication is a RevenueCat feature that verifies the identity of each Customer. Use it to connect your identity provider to RevenueCat, and to secure the requests between the RevenueCat SDK and RevenueCat. Authentication is in private beta and is not broadly available yet. Most apps continue to identify Customers with App User IDs.

📘Private beta

We want your feedback on Authentication. Tell us about your use case to get early access and help us shape the feature.

Authentication and API keys are different features

This article is about the identity of your Customers. For the keys that authenticate your app and your server with RevenueCat, see API Keys.

How authentication works​

Authentication has three parts. Your identity provider authenticates the Customer. Auth0, Okta, and Firebase Authentication are common identity providers. An authentication method in your RevenueCat project tells RevenueCat which identity provider to trust. An access token from RevenueCat then identifies the Customer in each SDK request.

The three parts work together in this order:

  1. The Customer logs in with your identity provider.
  2. Your app receives an ID token from the identity provider.
  3. Your app passes the ID token to the RevenueCat SDK. The SDK sends the token to the RevenueCat backend.
  4. RevenueCat validates the ID token against the authentication method that you configured.
  5. RevenueCat issues an access token for the Customer.
  6. The SDK sends the access token with each request that follows.

Your app no longer provides an App User ID to the RevenueCat SDK. RevenueCat reads the App User ID from the access token instead. Each Customer can therefore read and change only their own data.

The access token is valid for a short time. The SDK gets a new access token when the current token expires.

Authentication methods​

You configure authentication methods for each project. The Auth section of your project shows the methods that you configured. RevenueCat supports two types of authentication method:

  • OpenID Connect (OIDC): any identity provider that follows the OpenID Connect standard.
  • Firebase Authentication: a Firebase project. This method uses the Firebase project ID, the web API key, and the auth domain.

RevenueCat does not replace your identity provider. RevenueCat does not keep the passwords of your Customers, and it does not manage their accounts. Your identity provider owns both.

Features that need authentication​

Some operations are too sensitive for a public SDK API key, because it cannot prove which Customer sends the request. An access token can prove it, and it makes these features available:

  • Spend in-app currency from your app. Your app debits the balance of the Customer who is logged in. Without authentication, only your server can spend a balance. See In-App Currency.
  • Read Customer attributes from your app. Your app reads the attributes of the Customer who is logged in. Without authentication, only your server can read attributes. See Customer attributes.
  • Secure the calls to your own backend. Your app sends the RevenueCat access token to your backend. Your backend validates the signature of the token with the public keys of your project. Your backend then reads the App User ID from the token, and it does not need a separate session system.

Limitations​

  • Authentication needs iOS SDK version 5.88.0 or later. The feature is behind an internal flag. We are working on support for Android, and support for the hybrid SDKs will follow.
  • Your app must get an ID token from your identity provider before it can authenticate with RevenueCat. RevenueCat does not show a login screen in your app.

Next steps​

Was this page helpful?