Retool Mobile OAuth callback fails on Android - CSRF error on oauth.retool.com

💬 Mobile
,
1
  1. My goal:
    Authenticate users via OAuth (Zitadel OIDC) in our Retool Mobile app on Urovo DT50 Android warehouse scanners.
  2. Issue:
    OAuth callback to oauth.retool.com/oauth/user/oauthcallback fails with "CSRF DETECTED" error - but ONLY on Android Retool Mobile app.
    :white_check_mark: Works: iPhone Retool Mobile app
    :white_check_mark: Works: DT50 browser (web app)
    :cross_mark: Fails: DT50 Retool Mobile app → CSRF error
  3. Steps I've taken to troubleshoot:
  • Enabled refresh tokens in Zitadel OAuth client
  • Tested multiple browsers (Chrome, Firefox, incognito) - same issue
  • Cleared app cache and data
  • Verified Android System WebView is up to date
  • Checked App Links verification - found only retool.com is verified, NOT oauth.retool.com
  1. Additional info:
  • Cloud (Retool Cloud)
  • Android 13 on Urovo DT50 scanner
  • Zitadel OIDC authentication
  • Retool Mobile latest version
    Hypothesis: oauth.retool.com is not registered as a verified Android App Link, so the OAuth callback doesn't redirect back to the Retool Mobile app correctly on Android.
    Is there a way to get oauth.retool.com added as a verified Android App Link?
4

Hello @Nolunga_FARO, welcome to the Community! :star_struck: And thanks so much for reporting this! I have reached out to our engineers internally and will get back to you as soon as I hear back.