关于IdentityServer4是否支持API调用式用户认证的技术问询

Great question—this is a top concern for mobile app developers working with IdentityServer4, since keeping the login flow in-app makes for a way better user experience than bouncing users to an external webpage. The short answer is: you don’t have to use IdentityServer4’s hosted login/registration pages—you absolutely can handle authentication via API calls, but you’ll want to pick the right OAuth2/OIDC flow for your use case.

Option 1: Resource Owner Password Credentials Flow (Direct API Call) #

This is the most straightforward way to authenticate via API. With this flow, your mobile app collects the user’s username and password, then sends them directly to IdentityServer4’s /connect/token endpoint to request an access token.

Example Request #

POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=your_user&password=your_password&client_id=your_mobile_client&scope=your_api_scope openid&client_secret=your_client_secret

Key Notes #

• This flow is only recommended for trusted applications (i.e., apps you fully control, like your own internal mobile app). Never use this for third-party apps, since it requires handling user passwords directly in the client.
• Always use HTTPS to encrypt the request—never send credentials over plain HTTP.

Option 2: Authorization Code Flow with PKCE (Recommended for Modern Mobile Apps) #

While this flow traditionally involves a redirect to a login page, you can adapt it to work with your in-app UI for a seamless experience. Here’s how:

1. Build your own custom login/registration UI directly in your mobile app.
2. When the user submits their credentials, send them to IdentityServer4’s internal login endpoint (or a custom endpoint you build that integrates with IdentityServer’s authentication logic).
3. Retrieve the authorization code, then exchange it for an access token using the PKCE flow (which adds an extra layer of security to prevent authorization code interception).

This approach is more secure than the password flow and aligns with OAuth2 best practices for public clients like mobile apps. You can even customize IdentityServer4’s built-in login pages to match your app’s branding, then load that page in an in-app WebView if you don’t want to build the UI from scratch—this keeps the flow contained within your app without sending users to an external browser.

Can I Skip IdentityServer’s Authentication Logic Entirely? #

Yes, if you want to build your own full authentication system, you can still use IdentityServer4 as a token issuer. After validating the user’s credentials in your own API, you can call IdentityServer’s internal APIs to generate and issue tokens on behalf of the authenticated user. That said, this requires more work and you’ll miss out on IdentityServer’s built-in security features (like token validation, refresh token management, etc.).

Final Recommendations #

• For most mobile apps, go with Authorization Code Flow + PKCE—it’s the most secure and future-proof option.
• Use the password flow only if you have a trusted app and need a quick, simple integration.
• Avoid sending users to external web pages whenever possible—either build your own in-app UI or customize IdentityServer’s pages and load them in a WebView.

内容的提问来源于stack exchange，提问作者Sam