How does this work on Android devices?

The use of the form post response mode to pass the token back to the client complicates things. Intercepting the outgoing post with an intent filter will give you the url but not the post body. Android apps have two options that I have found: (1) use a webview with injected javascript to scrape the form data as it is posted or (2) a server-side solution, where the android client does not manage apple tokens at all.

Javascript injection is basically exploiting a security vulnerability in the WebView and not recommended by anyone, but it's there as a last resort. We're going with a server-side solution for now and keeping eyes and ears open for a third option.

@tsombrero I am trying using 1st option. I am able to successfully sign in from webview.

Problem I am facing while getting "code" from form_post response mode.

How to get "code" from form_post?

Thanks.