Flutter Authentication

Treat authentication as a protocol and account-state lifecycle spanning the identity provider, trusted backend, platform redirect surface, local session owner, and application UI. Preserve the project's provider, backend, SDK, router, storage, and state management unless migration is requested.

Installing this skill requires no Firebase, OAuth, OpenID, passkey, or other provider credential. Do not add an SDK, client registration, redirect association, secret placeholder, account, or backend merely because the skill is selected.

Preflight

Read pubspec.yaml, SDK constraints, sign-in entrypoints, provider and backend contract, registered clients and redirects, deep-link handling, token and account storage, refresh coordination, navigation guards, logout behavior, flavors, platform associations, and tests. Distinguish authentication, session state, authorization, and device-local re-authentication.

Native and web Flutter clients are public clients and cannot keep a reusable client secret. For OAuth or OIDC, use the established authorization-code flow with PKCE and an external user-agent where the provider supports it. Validate redirect ownership and correlate the response using state and, for OIDC, nonce as applicable. Never trust a redirect merely because its scheme matches.

Load references conditionally

• Read OAuth, OIDC, and redirects for browser authorization, PKCE, state, nonce, callback ownership, deep links, and provider errors.
• Read sessions and account state for token ownership, coordinated refresh, expiry, logout, revocation, account switching, startup restoration, and offline behavior.
• Read passkeys and device re-authentication for relying-party challenges, platform associations, passkey lifecycle, biometrics, and local authorization gates.

Boundaries