auth-foundation/com.okta.authfoundation.credential.kmp.storage/createEncryptedTokenStorage

createEncryptedTokenStorage

fun createEncryptedTokenStorage(context: Context, configuration: OAuth2ClientConfiguration, keyAlias: String = AndroidTokenEncryptionHandler.DEFAULT_KEY_ALIAS, requireBiometric: Boolean = false, userAuthenticationTimeout: Int = 5, promptInfo: BiometricPrompt.PromptInfo? = null, dbName: String = TokenDatabase.DB_NAME): RoomTokenStorage

Creates a RoomTokenStorage for Android applications, encrypting the access token via AndroidTokenEncryptionHandler (Android Keystore, with optional biometric gating).

Return

a configured RoomTokenStorage instance with encryption enabled.

Parameters

context

the Android application context.

configuration

the OAuth2ClientConfiguration used to reconstruct tokens.

keyAlias

the Android Keystore alias for the encryption key. Defaults to AndroidTokenEncryptionHandler.DEFAULT_KEY_ALIAS.

requireBiometric

when true, decrypting a stored token requires a biometric (or device credential) challenge. See AndroidTokenEncryptionHandler.

userAuthenticationTimeout

seconds after a successful biometric challenge during which decryption may proceed without re-prompting; 0 means "auth-per-use". Ignored when requireBiometric is false.

promptInfo

the BiometricPrompt.PromptInfo to display for biometric challenges. Required (non-null) when requireBiometric is true — see AndroidTokenEncryptionHandler.

dbName

the Room database file name. Defaults to TokenDatabase.DB_NAME.

fun createEncryptedTokenStorage(configuration: OAuth2ClientConfiguration, dbPath: String = ".okta", encryptionKeyProvider: () -> SecretKey? = null): RoomTokenStorage

Creates a RoomTokenStorage for JVM applications with AES-256-GCM encryption.

The encryption handler uses JceTokenEncryptionHandler by default, which manages encryption keys at ~/.okta/.encryption_key (Base64 encoded). Custom key providers can be supplied via encryptionKeyProvider.

Return

a configured RoomTokenStorage instance with encryption enabled.

Parameters

configuration

the OAuth2ClientConfiguration used to reconstruct tokens.

dbPath

the file system path for the database. Defaults to ~/.okta/common_token_database.

encryptionKeyProvider

optional lambda to provide a custom SecretKey. Defaults to JCE key management.