Android Keystore store access tokens

Question

In my application, upon user successful authentication using OAuth I need to store the access token returned by the REST API. I was thinking of using the keystore to store this token for further use in the application. But so far I havent seen an implementation which stores already generated keys using android keystore APIs. Is there any example or code snippet which stores already generated tokens.

Also if I use keystore to store the access tokens, can the rooted phone users gain access to these tokens?

Thanks.

Answer 1

The following blog post provides a very good explanation on how to go about doing this.

http://nelenkov.blogspot.com/2012/05/storing-application-secrets-in-androids.html

Also it should not matter if a rooted phone user can gain access to these tokens if they are encrypted. Fortunately, Android's system keystore daemon encrypts keys using AES.