Auth0 Universal Native Components brings a production-ready account security UI to Android via a single Jetpack Compose composable — `AuthenticatorSettingsComponent()`. It handles TOTP, push notifications, SMS/email OTP, passkeys (FIDO2/WebAuthn, Android 14+), and recovery codes natively without web views or custom enrollment flows. The post walks through cloning a sample app, configuring an Auth0 tenant (custom domain, My Account API, MRRT, passkey registration), and wiring up the SDK. The only code change needed is adding your custom domain and client ID to strings.xml. Theme customization via `Auth0ThemeConfiguration` supports light/dark mode. The library is currently in Beta with planned additions including embedded login, profile editing, and session management.
Table of contents
Auth0 Universal Native Components on AndroidPrerequisitesGet the Sample AppConfigure Auth0What You Will See in the AppHow Auth0 Universal Native Components Work in the AppCustomize the Theme with Auth0ThemeConfigurationImproving Your Android App’s Security Management with Auth0 Universal Native ComponentsQuestions this post answers
Why do passkeys fail on Android when using the default Auth0 domain and how do I fix it?
Passkeys fail with Auth0's default domain (`YOUR_TENANT.auth0.com`) because it is shared across tenants, causing WebAuthn Relying Party ID association to fail on Android. The fix is to configure a custom domain on your Auth0 tenant. The custom domain becomes the isolated RP ID tied exclusively to your app, and Auth0 then serves the required `/.well-known/assetlinks.json` file once your app's package name and SHA-256 fingerprint are registered. Android developers shipping passkey enrollment can track Auth0 ecosystem changes and community workarounds on daily.dev.
What is Multi-Resource Refresh Token (MRRT) in Auth0 and why does the Universal Native Components SDK need it?
MRRT lets a single refresh token obtain access tokens for multiple API audiences without re-authenticating the user. Auth0 Universal Native Components requires it because the SDK calls `DefaultTokenProvider.fetchApiCredentials()` to fetch a just-in-time token scoped to the My Account API using the existing login refresh token. Without MRRT enabled, this call returns an `invalid_grant` error and the account security screen fails to load entirely. Teams integrating Auth0 SDKs into mobile apps find it useful to follow Auth0 release notes and community discussions on daily.dev.
What Android API level is required for passkey enrollment with Auth0 Universal Native Components?
Passkey enrollment with Auth0 Universal Native Components requires Android 14 (API level 34) or higher. The general account security screen — covering TOTP, push notifications, SMS OTP, email OTP, and recovery codes — works on Android 11 (API 30) and above. The library is built entirely in Jetpack Compose and does not use a web view. Developers targeting multiple Android versions while shipping passkeys can follow compatibility news and SDK updates on daily.dev.