Every Flutter developer hits the auth wall eventually. You've built your beautiful cross-platform UI, your state management is clean, your navigation is smooth. Then you need users to log in. The options are overwhelming: - Firebase Authentication (ties you to Google's ecosystem) - flutter_appauth (OAuth complexity) - Various social login packages (platform-specific nightmares) - Custom JWT implementation (security concerns) This shows a pattern that sidesteps all of this. ## The Flutter Auth Landscape What you're typically choosing between: ### Firebase Auth ```dart // Seems simple. final credential = await FirebaseAuth.instance.signInWithEmailAndPassword( email: email, password: password, ); // Until you need: // - Custom email templates (limited customization) // - Self-hosted backend (can't use Firebase) // - Pricing predictability (usage-based) // - Data residency requirements (Google's servers) ``` ### OAuth Packages ```dart // flutter_appauth example final result = await appAuth.authorizeAndExchangeCode( AuthorizationTokenRequest( clientId, redirectUrl, discoveryUrl: discoveryUrl, scopes: ['openid', 'profile', 'email'], ), ); // Good luck configuring this for: // - Multiple platforms (iOS, Android, web, desktop) // - Development vs production environments // - Deep link handling differences ``` ### The Simpler Pattern ```dart // That's more like it Future startLogin(String email) async { await http.post( Uri.parse('$apiUrl/auth/login'), body: jsonEncode({'email': email}), headers: {'Content-Type': 'application/json'}, ); } ``` ## Complete Flutter Implementation Here's a full implementation using Turalogin: ### 1. Login Service ```dart // lib/services/auth_service.dart import 'dart:convert'; import 'package:http/http.dart' as http; import 'package:flutter_secure_storage/flutter_secure_storage.dart'; class AuthService { final String apiUrl; final storage = FlutterSecureStorage(); AuthService({required this.apiUrl}); Future startLogin(String email) async { final response = await http.post( Uri.parse('$apiUrl/auth/login'), body: jsonEncode({'email': email}), headers: {'Content-Type': 'application/json'}, ); return response.statusCode == 200; } Future verifyToken(String token) async { final response = await http.post( Uri.parse('$apiUrl/auth/verify'), body: jsonEncode({'token': token}), headers: {'Content-Type': 'application/json'}, ); if (response.statusCode == 200) { final data = jsonDecode(response.body); final sessionToken = data['sessionToken']; await storage.write(key: 'session', value: sessionToken); return data['email']; } return null; } Future isLoggedIn() async { final session = await storage.read(key: 'session'); return session != null; } Future logout() async { await storage.delete(key: 'session'); } } ``` ### 2. Deep Link Handler ```dart // lib/services/deep_link_service.dart import 'package:uni_links/uni_links.dart'; import 'dart:async'; class DeepLinkService { StreamSubscription? _subscription; final Function(String token) onAuthToken; DeepLinkService({required this.onAuthToken}); Future initialize() async { // Handle link that opened the app final initialLink = await getInitialLink(); if (initialLink != null) { _handleLink(initialLink); } // Handle links while app is running _subscription = linkStream.listen((link) { if (link != null) _handleLink(link); }); } void _handleLink(String link) { final uri = Uri.parse(link); if (uri.path == '/auth/verify') { final token = uri.queryParameters['token']; if (token != null) { onAuthToken(token); } } } void dispose() { _subscription?.cancel(); } } ``` ### 3. Login Screen ```dart // lib/screens/login_screen.dart import 'package:flutter/material.dart'; class LoginScreen extends StatefulWidget { @override _LoginScreenState createState() => _LoginScreenState(); } class _LoginScreenState extends State { final _emailController = TextEditingController(); bool _sent = false; bool _loading = false; Future _handleLogin() async { setState(() => _loading = true); final success = await context .read() .startLogin(_emailController.text); setState(() { _loading = false; _sent = success; }); } @override Widget build(BuildContext context) { if (_sent) { return Scaffold( body: Center( child: Column( mainAxisAlignment: MainAxisAlignment.center, children: [ Icon(Icons.mail, size: 64, color: Colors.green), SizedBox(height: 24), Text( 'Check your email!', style: Theme.of(context).textTheme.headlineSmall, ), SizedBox(height: 8), Text('Tap the link to log in.'), ], ), ), ); } return Scaffold( body: Padding( padding: EdgeInsets.all(24), child: Column( mainAxisAlignment: MainAxisAlignment.center, children: [ Text( 'Welcome', style: Theme.of(context).textTheme.headlineMedium, ), SizedBox(height: 32), TextField( controller: _emailController, decoration: InputDecoration( labelText: 'Email', border: OutlineInputBorder(), ), keyboardType: TextInputType.emailAddress, autocorrect: false, ), SizedBox(height: 16), SizedBox( width: double.infinity, child: ElevatedButton( onPressed: _loading ? null : _handleLogin, child: _loading ? CircularProgressIndicator() : Text('Continue'), ), ), ], ), ), ); } } ``` ### 4. Platform Configuration **Android (android/app/src/main/AndroidManifest.xml):** ```xml

``` **iOS (ios/Runner/Info.plist):** ```xml CFBundleURLTypes CFBundleURLSchemes myapp FlutterDeepLinkingEnabled ``` ## Why This Pattern Works ### Cross-Platform Consistency The same code works on: - iOS - Android - Web (with minor adjustments) - macOS - Windows - Linux No platform-specific OAuth configuration needed. ### Testability ```dart // Easy to mock class MockAuthService extends AuthService { @override Future startLogin(String email) async => true; @override Future verifyToken(String token) async => 'test@example.com'; } ``` Compare this to mocking Firebase Auth or OAuth flows. ### State Simplicity Your auth state is just: ```dart enum AuthState { unknown, unauthenticated, authenticated } ``` Not: ```dart enum AuthState { unknown, unauthenticated, authenticating, awaitingOAuthCallback, exchangingToken, refreshingToken, authenticated, tokenExpired, // . } ``` ## Backend Route (Your Server) Your server proxies to Turalogin: ```dart // If you're using Dart on the backend (shelf, dart_frog, etc.) Future handleLogin(Request request) async { final body = await request.readAsString(); final email = jsonDecode(body)['email']; final response = await http.post( Uri.parse('https://api.turalogin.com/v1/auth/start'), headers: { 'Content-Type': 'application/json', 'X-API-Key': Platform.environment['TURALOGIN_API_KEY']!, }, body: jsonEncode({ 'email': email, 'redirect_url': 'https://myapp.com/auth/verify', }), ); return Response.ok(jsonEncode({'sent': response.statusCode == 200})); } ``` ## The Flutter Auth Decision Tree ``` Do you need social login specifically? ├── Yes → Consider Firebase or flutter_appauth └── No → Do you need complex user management? ├── Yes → Consider Firebase or custom solution └── No → Use email-based auth (Turalogin) ``` Most apps fall into that last category. Simple, secure, cross-platform. --- *Building a Flutter app? [Get your Turalogin API key](/login) and skip the auth complexity.*