Xamarin.Auth vs MSAL: Choosing Silent Token Acquisition for Expired Refresh Tokens

Goal: Least‑Privilege Authentication with Robust Token Refresh

In a Xamarin.Forms app, the objective is to request only the scopes required for a feature, store the resulting access and refresh tokens securely, and refresh the access token silently when it expires. The design must also handle the case where the refresh token itself becomes invalid (revoked or expired).

Constraint: Platform‑Specific Secure Storage

Both Xamarin.Auth and Microsoft.Identity.Client (MSAL) rely on iOS Keychain and Android Keystore for token persistence. The behavior of silent token acquisition differs across these platforms, especially when the underlying refresh token is no longer valid.

Uncertainty: Silent Failure vs Interactive Fallback

It is unclear whether MSAL will silently fail on a revoked refresh token on Android, forcing an interactive prompt, whereas Xamarin.Auth may provide a more deterministic fallback path. The choice impacts user experience and compliance with least‑privilege principles.

Specific Questions

• Does MSAL silently fail to acquire a new access token when the stored refresh token is revoked on Android, and how is this detected?
• Can Xamarin.Auth be configured to automatically fall back to an interactive login when the refresh token expires, without exposing the user to unnecessary prompts?
• How do the differences in Keychain vs Keystore affect the detection of revoked refresh tokens and the overall security posture?