AFCore/com.advantahealth.api.authentication/Authentication/authenticateWithTokens

authenticateWithTokens

abstract suspend fun authenticateWithTokens(accessToken: String, refreshToken: String): AFResult

Authenticates by accepting tokens obtained outside the SDK ("BYO tokens" / host-injected flow).

This is a supported production entry point for the secure backend-token pattern: your backend performs the trusted token exchange (so the Advanta Client Secret never ships in the app) and hands the SDK the resulting access + refresh pair. It is the documented host-injection path — call it on login and again whenever the SDK reports SESSION_EXPIRED.

Use this when your app's own auth backend (or a server-side handshake) has already issued an AFCore-compatible access + refresh token pair and you want the SDK to adopt that session without running its own credential exchange. The SDK:

Parses the access token's JWT payload to extract identity claims. memberId/advantaMemberId and exp are required; externalUserId/externalId, iss, and clientId are read if present and logged otherwise.
Persists both tokens, the expiration, and the member identity so every other feature module works exactly as it does after the other two auth methods.
Emits com.advantahealth.api.SessionState.LOGGED_IN on sessionState.

Expiry handling. On a 401 during normal traffic, the SDK first tries POST /api/v1/auth/refresh with refreshToken. If that call also returns 401, the SDK clears the local session and emits com.advantahealth.api.SessionState.SESSION_EXPIRED. Host apps should observe sessionState (Kotlin) or call subscribeToSessionState (Swift) and, on SESSION_EXPIRED, obtain a fresh token pair and call this method again. Calling authenticateWithTokens a second time overwrites the prior pair and re-emits LOGGED_IN.

Return

AFResult with status = true when tokens were persisted and LOGGED_IN was emitted; false when required claims were missing, when either token was blank, or when the extracted memberId was "0".

Parameters

accessToken

JWT access token. Must contain exp and one of advantaMemberId / memberId claims, otherwise the call returns a failed AFResult without persisting anything.

refreshToken

Companion refresh token used by the SDK on subsequent 401 responses to obtain a new access token. Must be non-blank; the SDK does not validate it eagerly.

Throws

Throwable

on unexpected errors (storage failure, etc.).

Android (Kotlin) — after a server-side handshake

val (access, refresh) = myAuthClient.exchange()
val result = AFCore.authentication().authenticateWithTokens(access, refresh)
if (result.status) navigateToHome() else showError(result.statusMessage)

iOS (Swift) — observing re-authentication needed

AFCore.shared.authentication().subscribeToSessionState { state in
    if state == .sessionExpired {
        Task {
            let pair = await myAuthClient.exchange()
            _ = try? await AFCore.shared.authentication()
                .authenticateWithTokens(accessToken: pair.access,
                                        refreshToken: pair.refresh)
        }
    }
}