Mobile apps

Sign in with Apple is here because the App Store requires it: ship any third-party sign-in and Apple's own has to be offered alongside it. Google sits next to it, and magic link and email OTP cover everyone who wants neither.

Both OAuth rails run over PKCE with deep-link redirects, which is where mobile auth usually breaks — the universal-link cases where the browser hands control back to the wrong app, or to none. Sessions are token-first by design: short-lived access tokens, rotated refresh tokens in secure device storage, and a device registry so you can revoke one handset without signing out the rest. There is no email and password, on purpose.

Five rails, one entitlement. Apple through StoreKit and Google through Play Billing for in-app purchase, then Stripe, Paddle and Lemon Squeezy for the same product sold on your website.

The load-bearing distinction is that a product is not an entitlement. pro_monthly and pro_annual are two products, listed in three store catalogs under three different SKUs, granting one entitlement — pro. Your gate names the entitlement, so adding an annual plan or launching on a fourth store changes the catalog and nothing else.

Which is why someone who subscribes on their iPhone is entitled in a browser on their laptop, and why the receipt that proves it never leaves your D1.

Uploads land in your own R2 bucket with an owner, a quota and a lifecycle — not in a vendor's bucket you rent access to. For images, video, audio and documents there is a media capability that tracks and enriches them; for everything else, general file storage with the same ownership model.

In-app reports from a signed-in user land in the same inbox as email, in your own D1, classified on your own Workers AI binding — and already linked to the account, the purchases and the session behind them. You are not reading a ticket that says "it crashed" from an address you cannot place.

If the app has anything turn-based in it — a duel, a board, a table — the same authoritative sessions the games page describes run on the same Worker, with the phone as just another client. Async play is the mobile-native shape anyway: a Durable Object holding the state between turns costs nothing while nobody is taking one.

A new personal developer account owes Google a closed test before it may go to production: twelve testers, opted in, for fourteen continuous days. Lose one on day nine and the clock effectively restarts. The Play console does not show you a countdown, a roster health check, or who quietly opted out.

The testers capability holds the roster, sends and tracks the invitations, and answers the only question that matters — how many days are left, and is anybody about to break the streak.