Retool Mobile OAuth callback fails on Android - CSRF error on oauth.retool.com

💬 Mobile
,
1
  1. My goal:
    Authenticate users via OAuth (Zitadel OIDC) in our Retool Mobile app on Urovo DT50 Android warehouse scanners.
  2. Issue:
    OAuth callback to oauth.retool.com/oauth/user/oauthcallback fails with "CSRF DETECTED" error - but ONLY on Android Retool Mobile app.
    :white_check_mark: Works: iPhone Retool Mobile app
    :white_check_mark: Works: DT50 browser (web app)
    :cross_mark: Fails: DT50 Retool Mobile app → CSRF error
  3. Steps I've taken to troubleshoot:
  • Enabled refresh tokens in Zitadel OAuth client
  • Tested multiple browsers (Chrome, Firefox, incognito) - same issue
  • Cleared app cache and data
  • Verified Android System WebView is up to date
  • Checked App Links verification - found only retool.com is verified, NOT oauth.retool.com
  1. Additional info:
  • Cloud (Retool Cloud)
  • Android 13 on Urovo DT50 scanner
  • Zitadel OIDC authentication
  • Retool Mobile latest version
    Hypothesis: oauth.retool.com is not registered as a verified Android App Link, so the OAuth callback doesn't redirect back to the Retool Mobile app correctly on Android.
    Is there a way to get oauth.retool.com added as a verified Android App Link?
4

Hello @Nolunga_FARO, welcome to the Community! :star_struck: And thanks so much for reporting this! I have reached out to our engineers internally and will get back to you as soon as I hear back.

1 Like
5

Hi @ChiEn - was the team able to have a look? This issue is blocking production

6

Hey yes @Nolunga_FARO Our engineering team is actively working on this and is targeting a fix by the end of this week. I will keep you updated and let you know right away if anything changes. Thanks so much for your patience while we work through this. :raising_hands:

7

Hey there @Nolunga_FARO, our engineer is still working hard on a permanent solution for this. In the meantime, they’ve created a .apk app for you to download and use as a temporary workaround. I’ll DM you the app now! :folded_hands:

8

Hey! @Nolunga_FARO Just checking in, did the .apk file I sent via email work well for you?

9

Hey @Nolunga_FARO our engineers are still working through the Android release process, I will let you know once I have an update! Hope the temp app is working well as it should so far! :folded_hands:

2 Likes
10

Hey hey @Nolunga_FARO, good news! :partying_face: The CSRF issue has been resolved in Android version 3.355.0, which is rolling out now. Play Store auto-updates can take up to 48 hours to reach all users, so full availability is expected by Friday, March 20. If users want it sooner, they can manually update via the Play Store starting Wednesday, March 18!

Feel free to reach out with any questions!