Security & identity
Plugin.Maui.SecureSession
Access/refresh tokens, 401 retry, biometrics, multi-device
Current NuGet 1.0.7
Session ownership for MAUI: login, refresh, expiry, logout, multi-device revoke, and biometric unlock — tokens persist in SecureStoragePlus.
Install
dotnet add package Plugin.Maui.SecureSessionPackage ID: Plugin.Maui.SecureSession
Plugin.Maui.* restores from GitHub Packages. Add the org feed first — see Use nuvyntralabs GitHub Packages from a C# project.
Overview
Plugin.Maui.SecureSession owns the authentication session: login, Bearer attachment, single-flight refresh on 401 or near-expiry, rotating refresh tokens, idle and absolute timeouts, this-device or all-device logout, multi-device list/revoke, and biometric unlock after lock or process death. Persistence is delegated to SecureStoragePlus.
Current release
- 1.0.7. Current nuget.org pack.
- LoginAsync(TokenBundle) is still host-trusted by default. Set AcceptUnvalidatedTokens = false so only IAuthGateway can create a session.
Full upgrade map for the 3 September 2026 hardening wave: Hardened plugin releases.
Capabilities
- Login and GetAccessTokenAsync.
- Automatic 401 refresh and retry.
- Logout this device or every device.
- Multi-device session list and revoke.
- Face ID / fingerprint unlock.
- Optional IAuthGateway-only TokenBundle login.
- .NET MAUI
- Auth
- Tokens
- Biometrics
Discussion
Comment on Plugin.Maui.SecureSession. The thread lives on this component's GitHub repository (nuvyntralabs/Plugin.Maui.SecureSession). Sign in with GitHub — Giscus uses Discussions, Utterances uses Issues.