public final class OidcClient

Modern OpenID Connect / OAuth 2.0 client. Built around the authorization-code flow with PKCE (RFC 7636) and the system browser. Use it as the foundation for all new sign-in integrations:

OidcClient.discover("https://accounts.google.com").ready(new SuccessCallback<OidcClient>() {
    public void onSucess(OidcClient client) {
        client.setClientId("YOUR_CLIENT_ID")
              .setRedirectUri("com.example.app:/oauth2redirect")
              .setScopes("openid", "email", "profile");
        client.authorize().ready(new SuccessCallback<OidcTokens>() {
            public void onSucess(OidcTokens tokens) {
                // use tokens.getAccessToken() / tokens.getIdToken()
            }
        });
    }
});

What this gives you that Oauth2 does not

• Discovery via .well-known/openid-configuration so you only configure the issuer URL, not five separate endpoints
• PKCE S256 on every flow (mandatory; many providers now require it)
• System-browser sign-in via SystemBrowser (the previous class used an in-app WebView that modern IdPs reject)
• Refresh-token flow surfaced as a first-class method
• ID-token claim decoding via OidcTokens.getClaim(String)
• Pluggable TokenStore persistence
• Nonce + state verification on every authorization round-trip

Things this class deliberately does NOT do

• Verify the ID token signature. This requires the provider’s JWKS and ECDSA/RSA verification, which is not feasible on every supported platform without pulling in a heavy dep. The remedy is: trust the TLS connection to the well-known issuer (i.e. always discover, never pass tokens to a server without re-validating server-side).
• Implicit / hybrid / device flows. Use the lower-level ConnectionRequest APIs if you need those.