Store an Auth Token Securely
A practical pattern for persisting credentials.
Store an Auth Token Securely is a free Kotlin Multiplatform Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Kotlin Multiplatform Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Tokens Need a Home
After login, your app holds an auth token it must remember across restarts. Where you keep it matters a lot. 🔐
Plain Settings Isn't Secure
Regular Settings stores values in plain text. That's fine for a theme, but risky for a token that grants account access.
Encrypted Storage
For secrets, use platform-backed encrypted storage: the Keychain on iOS and EncryptedSharedPreferences on Android.
Hide It Behind an Interface
Define a small shared TokenStore interface so commonMain never knows which secure backend each platform uses.
interface TokenStore {
fun save(token: String)
fun read(): String?
fun clear()
}expect the Implementation
Declare the factory with expect in commonMain. Each platform supplies the secure actual version.
expect fun createTokenStore(): TokenStoreSave After Login
Right after a successful sign-in, write the token through your shared store. The UI never touches storage directly.
fun onLogin(store: TokenStore, token: String) {
store.save(token)
}Read on Startup
On launch, read the token to decide whether the user is already signed in or should see the login screen.
val loggedIn = store.read() != nullAttach to Requests
Feed the token into your Ktor client as a Bearer header so every authenticated call carries it automatically.
header("Authorization", "Bearer " + token)Clear on Logout
When the user signs out, clear the token so it can never be reused. Always wipe credentials deliberately.
fun onLogout(store: TokenStore) {
store.clear()
}Never Log Tokens
Keep tokens out of logs and crash reports. A leaked secret in a log file is as dangerous as plain-text storage.
One Pattern, Both Apps
This expect/actual pattern keeps your shared code clean while each platform handles secrets the secure, native way.
Quick Check
Let's confirm the secure-storage approach.
Recap
You store tokens in secure platform storage behind a shared TokenStore, save after login, clear on logout, and never log secrets. That wraps the course! 🎉
Frequently asked questions
Is the “Store an Auth Token Securely” lesson free?
Yes — the full text of “Store an Auth Token Securely” is free to read here on the web, and the Kotlin Multiplatform Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Kotlin Multiplatform Academy course, upgrade to CoddyKit PRO.
What will I learn in “Store an Auth Token Securely”?
A practical pattern for persisting credentials. You practise Kotlin Multiplatform Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Kotlin Multiplatform Academy?
No prior experience is required. Kotlin Multiplatform Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Store an Auth Token Securely” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Kotlin Multiplatform Academy lesson?
Yes. Every Kotlin Multiplatform Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why a Settings Abstraction
- Read & Write Typed Values
- Defaults & Clearing Keys
- Store an Auth Token Securely