[GH-ISSUE #695] Authenticate in the app with a token? #511

New issue

Open

opened 2026-05-07 00:24:58 +02:00 by BreizhHardware · 3 comments

BreizhHardware commented

2026-05-07 00:24:58 +02:00

Owner

Originally created by @BartG95 on GitHub (Apr 4, 2023).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/695

❓ Question

As of recently, ntfy gained the ability to authenticate with access tokens. Is it just me, or isn't that yet available in the Android app?

If not yet available, this issue might as well turn into a feature request.

Originally created by @BartG95 on GitHub (Apr 4, 2023). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/695 :question: **Question** As of recently, ntfy gained the ability to authenticate with access tokens. Is it just me, or isn't that yet available in the Android app? If not yet available, this issue might as well turn into a feature request.

BreizhHardware added the

question

label

2026-05-07 00:24:58 +02:00

BreizhHardware commented

2026-05-07 00:24:58 +02:00

Author

Owner

@binwiederhier commented on GitHub (Apr 18, 2023):

I think that's a pretty good idea. We may want to do this when we implement the user account sync stuff (#523, /cc @wunter8). My thought was to do it similarly to the web app. You log in with username/password, and then you create a token and store that locally. This way nothing would change from the user-perspective, but if your phone gets stolen your username/password is not at risk.

@binwiederhier commented on GitHub (Apr 18, 2023): I think that's a pretty good idea. We may want to do this when we implement the user account sync stuff (#523, /cc @wunter8). My thought was to do it similarly to the web app. You log in with username/password, and then you create a token and store that locally. This way nothing would change from the user-perspective, but if your phone gets stolen your username/password is not at risk.

BreizhHardware commented

2026-05-07 00:24:59 +02:00

Author

Owner

@killermouse0 commented on GitHub (Nov 19, 2023):

I would also love it if it was possible to provide an Oauth Personal Access Token, because my self-hosted NTFY instance is behind an authenticating proxy (Zitadel). Might be too much of a niche request, but I'm just putting it here to gauge interest from others!

@killermouse0 commented on GitHub (Nov 19, 2023): I would also love it if it was possible to provide an Oauth Personal Access Token, because my self-hosted NTFY instance is behind an authenticating proxy (Zitadel). Might be too much of a niche request, but I'm just putting it here to gauge interest from others!

BreizhHardware commented

2026-05-07 00:24:59 +02:00

Author

Owner

@brevilo commented on GitHub (Jan 30, 2024):

I think that's a pretty good idea. We may want to do this when we implement the user account sync stuff (#523, /cc @wunter8).

This sounds like this could take some time. Please correct me if I'm wrong but it seems like the low-hanging fruit could be to just disable the input validation on the user name field and accept an empty one, no? The token doc reads:

Alternatively, you can use Basic Auth to send the access token. When sending an empty username, the basic auth password is treated by the ntfy server as an access token.

Sure, things can be still be optimized down the road but this looks like a simple enough change to enable token support in the app relatively quickly, further protecting original account credentials.

Thanks!

@brevilo commented on GitHub (Jan 30, 2024): > I think that's a pretty good idea. We may want to do this when we implement the user account sync stuff (#523, /cc @wunter8). This sounds like this could take some time. Please correct me if I'm wrong but it seems like the low-hanging fruit could be to just disable the [input validation](https://github.com/binwiederhier/ntfy-android/commit/43757eb7b5be2b0a55f4a59c497dcd6dfc39494c#diff-801c4a80b2064174f4d9a2b6c33f0f6be9fdbedc7f59509f137f8dc33762d177R112) on the user name field and accept an empty one, no? The [token doc](https://docs.ntfy.sh/publish/#access-tokens) reads: > Alternatively, you can use [Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication) to send the access token. When sending an empty username, the basic auth password is treated by the ntfy server as an access token. Sure, things can be still be optimized down the road but this looks like a simple enough change to enable token support in the app relatively quickly, further protecting original account credentials. Thanks!