Authentication and access

#OAuth 2.1 + PKCE

re: uses Resend’s authorization flow (“Sign in with Resend”) with PKCE. It’s a public client: there’s no client secret shipped in the app. Every sign-in generates a fresh code_verifier, so only the app that started the flow can exchange the code for a token. The redirect back to the app uses its own scheme, re://oauth/callback.

#Client ID (CIMD)

The client is identified by a metadata document (CIMD) hosted on our domain. The document’s URL is the client_id itself:

https://tryre.dev/oauth/client.json

That’s why Resend’s consent screen shows the host tryre.dev. The document is public and lists the client name, the allowed redirects and the scopes.

#Scopes

With full_access the app reads what the dashboard sees, but only changes something when you tap. Destructive actions ask for confirmation, and Face ID if you turn on Ask for Face ID on destructive actions. The app sums this up in Settings › What can re: access?.

#Where the token lives

The access and refresh tokens stay on the device only, in the system’s secure storage: the Keychain on iOS and the Keystore on Android. On iOS the item is marked “this device only”, so it’s not included in backups or moved to another iPhone. The token is never sent to the relay or to any server of ours.

#Lifetime and refresh

• The access token lasts 15 minutes and renews on its own.
• The refresh token rotates on every renewal. As long as you use the app, the session stays alive.
• Renewals for the same team go through a single queue. Reusing an old refresh token makes Resend revoke the whole authorization, and the app prevents that.
• Widgets never refresh the token. See Widgets.

If Resend refuses a renewal, the session expires and the app asks you to sign in again. Alerts and preferences stay saved.

#Revoke access

From the app: Settings › Sign out revokes access on Resend right away and deletes the token from the device. With multiple teams, Sign out of this team revokes only the active team.

From the Resend dashboard: remove re:’s authorization from the list of connected applications. On the next call, the app gets the refusal and goes back to the sign-in screen.