OAuth2 callback launches activity inside the browser on some devices

Question

I've implemented OAuth2 for Coinbase inside an Android app. The app flow is as follows. A user clicks on a "link with Coinbase" button, the call to the OAuth2 endpoint https://www.coinbase.com/oauth/authorize is made. Then the system browser opens up with the Coinbase OAuth page, where the user is asked to sign in and authorize the app. Once this is done, the app is called back via a custom URI scheme:

<intent-filter>
    <action android:name="android.intent.action.VIEW" />
    <category android:name="android.intent.category.DEFAULT" />
    <category android:name="android.intent.category.BROWSABLE" />
    <data android:scheme="myapp" android:pathPrefix="/coinbase-oauth" />
</intent-filter>

Inside the activity with this filter, which is the same activity the user started the initial OAuth process from, the onNewIntent(Intent intent) method is called getting the code via the intent and finishes the authorization by getting a token. This is the preferred way and how we want OAuth to behave, all good.

However, on some devices, the BROWSABLE activity is recreated inside the browser. We reach onCreate() of the activity and can also get the OAuth code from the intent, however, I am unable to get back into the app. The initial activity that launched the browser for authorization is still in the background waiting for a response. The newly created version of the activity is essentially decoupled. While it can finalize the job, I want users to get back into the app.

Answer 1

The problem is nothing but you need the callback to the same activity where you start the authentication process. I think Coinbase API not intended to use that way.

To resolve the issue, simply specify the launch mode singleInstance for the activity by adding the following attribute to the activity tag.

android:launchMode= "singleInstance"

See the docs for more details.