Xamarin.Auth vs MSAL: Choosing Silent Token Acquisition for Expired Refresh Tokens

Answer

MSAL does **not** silently fail when the stored refresh token is revoked or expired on Android (or iOS). A call to AcquireTokenSilent throws MsalUiRequiredException (or a MsalServiceException with error interaction_required). The app can catch this exception and then invoke an interactive login flow.

Detecting the failure with MSAL

try
{
    var result = await app.AcquireTokenSilent(scopes, account)
                         .ExecuteAsync();
    // use result.AccessToken
}
catch (MsalUiRequiredException ex)
{
    // refresh token is invalid → start interactive auth
    var interactiveResult = await app.AcquireTokenInteractive(scopes)
                                      .WithAccount(account)
                                      .ExecuteAsync();
}

For Xamarin.Auth, a silent refresh (RefreshTokenAsync) throws an AuthenticationException whose message typically contains invalid_grant. You must catch this exception and then launch the authenticator’s UI to obtain a new token pair.

Fallback configuration for Xamarin.Auth

try
{
    var newToken = await authenticator.RefreshTokenAsync(params, cancellationToken);
}
catch (AuthenticationException ex) when (ex.Message.Contains("invalid_grant"))
{
    // start interactive login (e.g., presenter.Login())
    await presenter.LoginAsync();
}

Impact of Keychain vs Keystore

Both libraries store tokens in the platform‑specific secure storage (iOS Keychain, Android Keystore/AccountManager or EncryptedSharedPreferences). The storage mechanism does **not** change how revocation is detected—the authority’s token response determines validity. However, Android’s hardware‑backed Keystore offers stronger protection against token extraction than software‑only storage, while iOS Keychain provides comparable hardware‑backed security.

Missing diagnostic detail

To be certain that observed silent failures are due to token revocation and not storage‑related issues, confirm which Android storage you are using for MSAL/Xamarin.Auth (Keystore vs AccountManager). If you are using AccountManager, clearing the account or disabling the app can produce similar silent failures unrelated to token status.