how to securely store the access token , refresh token or any key in android , ios device ?

Secure Token Storage

Storing access tokens securely is critical for app security.

Android Secure Storage

dartCopy
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

final _storage = FlutterSecureStorage();

// Write token
Future<void> saveToken(String token) async {
  await _storage.write(key: 'access_token', value: token);
}

// Read token
Future<String?> getToken() async {
  return await _storage.read(key: 'access_token');
}

// Delete token
Future<void> deleteToken() async {
  await _storage.delete(key: 'access_token');
}

iOS Secure Storage

iOS Keychain (same API as Android)

dartCopy
// Same code works on iOS
// Uses iOS Keychain under the hood
await _storage.write(key: 'refresh_token', value: refreshToken);

Best Practices

• Never store tokens in SharedPreferences (not encrypted)
• Use FlutterSecureStorage (encrypted)
• Implement token refresh logic
• Clear tokens on logout
• Use HTTPS only
• Implement certificate pinning

dartCopy
// Token refresh example
Future<String> getValidToken() async {
  String? token = await _storage.read(key: 'access_token');
  
  if (_isTokenExpired(token)) {
    token = await _refreshToken();
    await _storage.write(key: 'access_token', value: token!);
  }
  
  return token!;
}

Never: Store passwords, only tokens.