Notifications
Clear all
Topic starter
16/08/2026 1:12 pm
TL;DR: Browser-based login can disrupt mobile user experience, fragment session handling, and limit control over how authentication resumes after OAuth or magic-link hops, according to Descope. Native flows shift authentication into the app shell, but the governance question is how to keep session control, step-up checks, and deep-link handling aligned with identity policy.
NHIMG editorial — based on content published by Descope: Add Authentication to Kotlin With Descope Native Flows
By the numbers:
- 91% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments.
- 33% of organisations report their AI agents have accessed inappropriate or sensitive data beyond their intended scope.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: How should teams govern mobile authentication without relying on browser sessions?
A: Treat the mobile app as part of the identity control plane, not just a presentation layer.
Q: Why do deep links matter to identity governance in mobile apps?
A: Because they determine whether an external authentication step returns the user to the correct session and policy path.
Q: When should organisations require step-up authentication in native app flows?
A: Require step-up authentication for sensitive actions, account recovery, device changes, and profile transitions that materially change risk.
Practitioner guidance
- Map app login to identity states Define the exact transitions for new user, returning user, step-up authentication, and profile completion, then verify that each path ends in a valid and auditable session state.
- Test return-path integrity end to end Validate OAuth and magic-link deep links in real devices, including app links, assetlinks verification, and recovery when the app is resumed from background or cold start.
- Centralise session refresh rules Make the token refresh and revocation path consistent across app restarts, logout, and backend session invalidation so the mobile client does not drift from policy.
What's in the full article
Descope's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step Kotlin SDK setup and application initialisation for native flows.
- Android deep-link and app-link configuration details, including intent filters and assetlinks.json hosting.
- Code examples for session management, logout, and session revocation handling.
- Flow branching examples for mobile versus web authentication paths and step-up prompts.
👉 Read Descope's guide to native authentication flows in Kotlin apps →
Native auth flows in Kotlin apps: what changes for IAM teams?
Explore further
16/08/2026 1:14 pm
Native mobile authentication shifts the control problem from browser trust to session governance. The article shows that embedded auth can reduce friction, but the real identity issue is whether the app can enforce consistent session rules without assuming browser-managed state. For human IAM teams, that means authentication design and session governance are now inseparable.
A few things that frame the scale:
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: What is the difference between native flows and browser-based authentication?
A: Native flows keep the sign-in experience inside the app through embedded flow components, while browser-based authentication sends the user out to Safari or another browser. The difference is not just presentation. Native flows give the app more direct control over continuity, state handling, and the user’s return path after authentication.
👉 Read our full editorial: Native mobile authentication reduces auth friction in Kotlin apps
