One tap sign-up and automatic sign-in without password entry using Smart Lock

The

What’s New

With the latest release of Google Play services, we’ve made some enhancements to the Smart Lock for Passwords API to help you sign up new users or sign existing users in more quickly. Using the new

This new experience is particularly important with Android Marshmallow’s runtime permissions model. To simplify and improve the user experience, this dialog doesn’t require device permissions and includes any email addresses that the user has saved with Smart Lock, not just the accounts on the device. This means that you can improve your sign-in and sign-up flows so that most of your users never need to type their email address. Apps using this dialog have seen nearly three-quarters of users select an entry shown, improving sign-up rates.

Next, after the user has tapped and shared their email address, with some server-side support, a sophisticated app can fully tailor the sign-in flow. By using the email address, you can check your database to see if a user has already registered for an account. You can then intelligently render either the sign-in or sign-up screens with the user’s email address, name and profile photo pre-filled.

Skipping the Password Altogether

It’s possible to do even better: if the user chooses a Google account from the dialog, an OpenID Connect altogether for returning users. ID tokens are also used by

When your app starts, , or you can use an open-source implementation. The ID token contains the user’s email address, and you can look it up in your database to determine whether an account needs to be created.

 GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)  

         .setIssuer("https://accounts.google.com")  

         .setAudience(Arrays.asList(String.format("android://%s@%s",   

                             SHA512_HASH, PACKAGE_NAME)))  

         .build();  

 ...  

     GoogleIdToken idToken = verifier.verify(idTokenString);  

     if (idToken == null) {  

       Log.w(TAG, "ID Token Verification Failed, check the README for instructions.");  

       return;  

     }  

     GoogleIdToken.Payload payload = idToken.getPayload();  

     Log.d(TAG, "IdToken:Email:" + payload.getEmail());  

     Log.d(TAG, "IdToken:EmailVerified:" + payload.getEmailVerified());  

     // based on the email address, determine whether you need to create account   

     // or just sign user in  

Then save the user’s email address credential “hint” in Smart Lock for automatic sign-in next time. Simply call the Credentials API for a step-by-step guide. We’re excited to make authentication without passwords possible via Smart Lock and are looking forward to a world where not only credentials can be managed more effectively, but apps can get their users signed in and up quickly and securely without the friction of typing usernames and passwords. We’d love to hear !