<commit_before>---
description: Learn how the mobile login flow works and why you should use it for mobile apps.
topics:
  - authorization-code
  - pkce
  - api-authorization
  - grants
  - authentication
contentType: concept
useCase:
  - secure-api
  - call-api
  - add-login
---
# Mobile Login Flow

<%= include('_includes/_pipeline2') %>

When you are building a [mobile app](/quickstart/native), the mobile login flow is the best way to control access to your app. 


::: note
Each login flow builds off of an [OAuth 2.0](/protocols/oauth2) grant; in this case, we use the [Authorization Code Grant with Proof Key for Code Exchange (PKCE, pronounced "pixie") enhancement](https://oauth.net/2/pkce/) (as defined in [RFC 7636](https://tools.ietf.org/html/rfc7636)), which is similar to the standard [Authorization Code Grant](https://oauth.net/2/grant-types/authorization-code/), but contains a few extra steps.
:::

## How it works

![Authorization Code Grant using PKCE](/media/articles/api-auth/authorization-code-grant-pkce.png)

 1. Your app generates a cryptographically-random key called a `code_verifier` and creates a `code_challenge` from the verifier. Then it initiates the flow and redirects the user to Auth0 ([/authorize endpoint](/api/authentication#authorization-code-grant-pkce-)), sending the `code_challenge` and `code_challenge_method` parameters. The user authenticates.<commit_msg>Update mobile-login-flow.md<commit_after>---
description: Learn how the mobile login flow works and why you should use it for mobile apps.
topics:
  - authorization-code
  - pkce
  - api-authorization
  - grants
  - authentication
contentType: concept
useCase:
  - secure-api
  - call-api
  - add-login
---
# Mobile Login Flow

<%= include('../../../_includes/_pipeline2') %>

When you are building a [mobile app](/quickstart/native), the mobile login flow is the best way to control access to your app. 


::: note
Each login flow builds off of an [OAuth 2.0](/protocols/oauth2) grant; in this case, we use the [Authorization Code Grant with Proof Key for Code Exchange (PKCE, pronounced "pixie") enhancement](https://oauth.net/2/pkce/) (as defined in [RFC 7636](https://tools.ietf.org/html/rfc7636)), which is similar to the standard [Authorization Code Grant](https://oauth.net/2/grant-types/authorization-code/), but contains a few extra steps.
:::

## How it works

![Authorization Code Grant using PKCE](/media/articles/api-auth/authorization-code-grant-pkce.png)

 1. Your app generates a cryptographically-random key called a `code_verifier` and creates a `code_challenge` from the verifier. Then it initiates the flow and redirects the user to Auth0 ([/authorize endpoint](/api/authentication#authorization-code-grant-pkce-)), sending the `code_challenge` and `code_challenge_method` parameters. The user authenticates.
{'fraction_non_alphanumeric': 0.1108365690081186, 'fraction_numerical': 0.011295446523120367, 'mean_word_length': 4.287313432835821, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7579321', 'n_tokens_mistral': 869, 'n_tokens_neox': 824, 'n_words': 304}