Authentication and Tokens

Authentication is a critical aspect of secure app development. APIs often require authentication to ensure that only authorized users can access certain resources or perform sensitive actions. Instead of sending a username and password with every request, APIs commonly use tokens, unique strings issued upon successful login, to identify and authorize users. This approach improves both security and convenience by allowing users to authenticate once and use the resulting token for subsequent requests.

In the code above, when a user logs in, the app sends their credentials to the API and receives a bearer token in response. This token is stored using a secure local storage solution (SharedPreferences in this case). Every time the app makes a protected API call, it retrieves the token and attaches it to the Authorization header as Bearer <token>. This ensures that only authenticated users can access protected endpoints, and the token is never hardcoded or exposed in the source code.