Hi, I had a quick look into this and some of the Android Restore Credentials API documentation implies that a backend is involved: e.g. https://developer.android.com/agents/skills/identity/restore-credentials/skill
I'm not clear from the documentation whether this is a requirement or advisory, but this should be a consideration. On Fri, Oct 9, 2026 at 10:09 PM Norman Breau via dev <[email protected]> wrote: > Hi all, > > This is to start a discussion thread and hopefully to develop a formal > consensus on how Apache Cordova should handle the upcoming requirement > regarding zero-tap sign in. > > If you're not already familiar, Google has announced that starting April > 2027, apps supporting a user sign-in flow (whether mandatory or > optional) must automatically restore the sign-in state when the user > migrates the app from one device to another, using the Android Restore > Credentials API. The announcement can be found at > > https://android-developers.googleblog.com/2026/08/app-quality-memory-optimization-secure-onboarding.html > near the bottom, under the "Providing a secure & seamless device > migration experience" header. > > Generally when things are add-ons, we leave that to the community to > support so that Apache can focus on bridging the gaps in web features > and supporting the core platform, and that could probably extend to > restore credentials integration as well, because Apache doesn't provide > any tools for supporting user sign-in flows either, no apache-maintained > API for accessing the encrypted storage mechanism to store access > tokens, but users **could** get by with using web storage. User sign-in > flows is something that is very common requirement in many apps so that > begs the question and I believe will start requiring app integration. So > that begs the question on: > > 1) Whether Apache Cordova should provide a Restore Credentials Solution > 2), and if so, should the solution be part of the core android framework > or be a separate plugin to be installed. > > Or should the community take responsibility of providing the Restore > Credentials integration. > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
