Andres dos Santos

How I solved the authentication problem to bypass In-App Purchases

How do you securely move an authenticated user from an app to a website for subscriptions? In this post, I explain how I solved this in Dodo using Expo Web Browser, Redis temporary tokens, and re-authentication.

Imagine you have an app and it contains plans and subscriptions. You have the option to use in-app purchases, but they charge from 15% up to 30% and honestly, that is a lot.

But there is a way to work around this problem, and that is what I did in Dodo. It is an approach that is already known and used in other places, but I will explain how I did it.

The first thing was: “how do I move the user outside of my app?”. For that, I used expo-web-browser, but then I had a problem: “how am I going to keep the user authenticated?”. So I thought, I need to authenticate the user again when the website opens. Then the flow became this:

User selects a plan on mobile → it calls the API → the API returns a URL with a token stored in Redis with an expiration time → the app opens the website passing the token → as soon as the website opens, the user is authenticated again and now they have a valid token to complete a subscription.

This flow involves the app, API, and website. It is quite complete and secure, given that simply opening the website to confirm the plan is not a valid option because the user would not be authenticated.