Manage credentials

Amplify Flutter v1 is now in Maintenance Mode until April 30th, 2025. This means that we will continue to include updates to ensure compatibility with backend services and security. No new features will be introduced in v1.

Please use the latest version (v2) of Amplify Flutter to get started.

If you are currently using v1, follow these instructions to upgrade to v2.

The Amplify Auth category persists authentication-related information to make it available to other Amplify categories and to your application.

Amplify Flutter securely manages credentials and user identity information. You do not need to store, refresh, or delete credentials yourself. Amplify Flutter stores auth data on the device using platform capabilities such as Keychain Services on iOS and macOS and EncryptedSharedPreferences on Android.

Amplify will refresh the Access Token and ID Token as long as the Refresh Token is valid. Once the Refresh token expires, the user will need to reauthenticate to obtain a new one.

Some platform specific option can be customized with the out of the box options. In the example below, credentials will be stored in-memory on Web instead of the default behavior of using browser storage.

await Amplify.addPlugin(
  AmplifyAuthCognito(
    secureStorageFactory: AmplifySecureStorage.factoryFrom(
      webOptions: WebSecureStorageOptions(
        persistenceOption: WebPersistenceOption.inMemory,

If you would like further customization, you can provide your own factory for creating SecureStorageInterface instances to AmplifyAuthCognito. The example below shows the use of a custom implementation that stores data in-memory on all platforms.

await Amplify.addPlugin(
  AmplifyAuthCognito(secureStorageFactory: InMemoryStorage.new),

class InMemoryStorage implements SecureStorageInterface {
  InMemoryStorage(this.scope);
  /// The scope of the item being stored.
  /// This can be used as a namespace for stored items.
  final AmplifySecureStorageScope scope;
  static final Map<String, String> _data = {};
  @override
  void write({required String key, required String value}) {
    _data['${scope.name}.$key'] = value;
  @override
  String? read({required String key}) {
    return _data['${scope.name}.$key'];
  @override
  void delete({required String key}) {
    _data.remove('${scope.name}.$key');