public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc();
            // 1. Add Authentication Services
            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(options =>
            {
                options.Authority = "https://devday2gis.auth0.com/";
                options.Audience = "https://devday.api";
            });
        }
        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            // 2. Add Authentication
            app.UseAuthentication();
            app.UseMvc();
        }

 private void login() {
        token.setText("Not logged in");
        Auth0 auth0 = new Auth0(this);
        auth0.setOIDCConformant(true);
        WebAuthProvider.init(auth0)
                .withScheme("demo")
                .withAudience(String.format("https://%s/userinfo", getString(R.string.com_auth0_domain)))
                .withScope("openid email profile")
                .start(MainActivity.this, new AuthCallback() {
                    @Override
                    public void onSuccess(@NonNull final Credentials credentials) {
                        runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                idToken = credentials.getIdToken();
                                accessToken = credentials.getAccessToken();
                                Log.d("id token", credentials.getIdToken());
                                Log.d("access token", credentials.getAccessToken());
                                token.setText("Logged in: " + credentials.getIdToken());
                            }
                        });
                    }
                    @Override
                    public void onFailure(@NonNull final Dialog dialog) {
                        runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                dialog.show();
                            }
                        });
                    }
                    @Override
                    public void onFailure(final AuthenticationException exception) {
                        runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                Toast.makeText(MainActivity.this, "Error: " + exception.getMessage(), Toast.LENGTH_SHORT).show();
                            }
                        });
                    }
                });
    }

Consider two cases of key theft:

1. The scoundrel stole only the AccessToken. Then it will be valid only until you use your RefreshToken.
2. The scoundrel stole both tokens. Then, as soon as it uses RefreshToken, your tokens will cease to function and you will be logged out of the application. If you use your credentials, then the attacker's tokens will cease to act.
   Using two tokens limits the time that an attacker will have access to your APIs.

private void makeApiCall()
    {
        DevDayApi api = CreateApi("http://rnd-123.2gis.local/", accessToken);
        api.getUserProfile().enqueue(new Callback() {
            @Override
            public void onResponse(Call call, Response response) {
                runOnUiThread(() -> {
                    if(response.body() != null)
                        apiAnswer.setText(response.body().Answer);
                });
            }
            @Override
            public void onFailure(Call call, Throwable t) {
                apiAnswer.setText(t.getMessage());
            }
        });
    }
    private DevDayApi CreateApi(String baseUrl, String authToken)
    {
        HttpLoggingInterceptor logging = new HttpLoggingInterceptor();
        logging.setLevel(HttpLoggingInterceptor.Level.HEADERS);
        OkHttpClient client = new OkHttpClient.Builder()
                .addInterceptor(chain -> {
                    Request newRequest = chain.request().newBuilder()
                            .addHeader("Authorization", "Bearer " + authToken)//tokenProvider.getAuthToken())
                            .build();
                    return chain.proceed(newRequest);
                })
                .addInterceptor(logging)
                .build();
        Retrofit retrofit = new Retrofit.Builder()
                .client(client)
                .baseUrl(baseUrl)
                .addConverterFactory(GsonConverterFactory.create())
                .build();
        return retrofit.create(DevDayApi.class);
    }

import { Injectable } from '@angular/core';
import { AUTH_CONFIG } from './auth0-variables';
import { Router } from '@angular/router';
import * as auth0 from 'auth0-js';
@Injectable()
export class AuthService {
  auth0 = new auth0.WebAuth({
    clientID: AUTH_CONFIG.clientID,
    domain: AUTH_CONFIG.domain,
    responseType: 'token id_token',
    audience: `https://${AUTH_CONFIG.domain}/userinfo`,
    redirectUri: AUTH_CONFIG.callbackURL,
    scope: 'openid'
  });
  constructor(public router: Router) {}
  public login(): void {
    this.auth0.authorize();
  }
  public handleAuthentication(): void {
    this.auth0.parseHash((err, authResult) => {
      if (authResult && authResult.accessToken && authResult.idToken) {
        this.setSession(authResult);
        this.router.navigate(['/home']);
      } else if (err) {
        this.router.navigate(['/home']);
        console.log(err);
        alert(`Error: ${err.error}. Check the console for further details.`);
      }
    });
  }
}

UsernamestringTextBoxUser's Object's Tenant IDstringTenant identifier (ID) of the user object in Azure AD.User's Object IDstringObject identifier (ID) of the user object in Azure AD.Sign in namestringTextBoxEmail AddressstringEmail address to use for signing in.TextBoxPasswordstringEnter passwordPasswordNew PasswordstringEnter new passwordPasswordConfirm New PasswordstringConfirm new passwordPasswordPassword PoliciesstringPassword policies used by Azure AD to determine password strength, expiry etc.client_idstringSpecial parameter passed to EvoSTS.Special parameter passed to EvoSTS.resource_idstringSpecial parameter passed to EvoSTS.Special parameter passed to EvoSTS.SubjectstringAlternativeSecurityIdstringMailNickNamestringYour mail nick name as stored in the Azure Active Directory.Identity ProviderstringDisplay NamestringYour display name.TextBoxPhone NumberstringXXX-XXX-Your telephone numberVerified Phone NumberstringXXX-XXX-Your office phone number that has been verifiedNew Phone Number EnteredbooleanUserId for MFAstringEmail AddressstringEmail address that can be used to contact you.TextBoxAlternate Email AddressesstringCollectionEmail addresses that can be used to contact the user.UserPrincipalNamestringYour user name as stored in the Azure Active Directory.UPN User NamestringThe user name for creating user principal name.User is newbooleanExecuted-SelfAsserted-InputstringA claim that specifies whether attributes were collected from the user.AuthenticationSourcestringSpecifies whether the user was authenticated at Social IDP or local account.ncastringSpecial parameter passed for local account authentication to login.microsoftonline.com.grant_typestringSpecial parameter passed for local account authentication to login.microsoftonline.com.scopestringSpecial parameter passed for local account authentication to login.microsoftonline.com.objectIdFromSessionbooleanParameter provided by the default session management provider to indicate that the object id has been retrieved from an SSO session.isActiveMFASessionbooleanParameter provided by the MFA session management to indicate that the user has an active MFA session.Given NamestringYour given name (also known as first name).TextBoxSurnamestringYour surname (also known as family name or last name).TextBoxLineMarkers, MetaRefresh~/tenant/default/exception.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:globalexception:1.1.0Error page~/tenant/default/idpSelector.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:idpselection:1.0.0Idp selection pageSign in~/tenant/default/idpSelector.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:idpselection:1.0.0Idp selection pageSign up~/tenant/default/unified.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:unifiedssp:1.0.0Signin and Signup~/tenant/default/multifactor-1.0.0.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:multifactor:1.1.0Multi-factor authentication page~/tenant/default/selfAsserted.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0Collect information from user page~/tenant/default/updateProfile.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0Collect information from user page~/tenant/default/selfAsserted.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0Local account sign up page~/tenant/default/selfAsserted.cshtml~/common/default_page_error.htmlurn:com:microsoft:aad:b2c:elements:selfasserted:1.1.0Local account change password pagefacebook.comFacebookFacebookfacebookhttps://www.facebook.com/dialog/oauthhttps://graph.facebook.com/oauth/access_tokenGET0jsonLocal Account SignInLocal Account SignInWe can't seem to find your accountYour password is incorrectLooks like you used an old passwordhttps://sts.windows.net/https://login.microsoftonline.com/{tenant}/.well-known/openid-configurationhttps://login.microsoftonline.com/{tenant}/oauth2/tokenid_tokenqueryemail openidfalsePOSTPhoneFactorPhoneFactorapi.phonefactortrueAzure Active DirectoryAzure Active DirectoryfalseWritetrueYou are already registered, please press the back button and sign in instead.falseReadtrueUser does not exist. Please sign up before you can sign in.falseWritetruefalseReadtrueAn account could not be found for the provided user ID.falseWritetruefalseWritefalsetruefalseReadtruefalseWritefalsetruefalseSelf AssertedUser ID signupapi.selfassertedUser ID signupapi.selfasserted.profileupdatefalseLocal AccountEmail signupIpAddressapi.localaccountsignupCreateLocal Account SigninSignUpWithLogonEmailExchangeEmailapi.selfassertedfalseReset password using email addressIpAddressapi.localaccountpasswordresetfalseChange password (username)api.localaccountpasswordresetSession ManagementNoop Session Management ProviderSession Mananagement ProviderSession Mananagement ProvidertrueSession Mananagement ProviderTrustframework Policy Engine TechnicalProfilesTrustframework Policy Engine Default Technical Profile{service:te}Token IssuerJWT IssuerJWT{service:te}objectIdtrueobjectIdSkipThisOrchestrationStepauthenticationSourcelocalAccountAuthenticationSkipThisOrchestrationStepobjectIdSkipThisOrchestrationStepauthenticationSourcesocialIdpAuthenticationSkipThisOrchestrationStepobjectIdSkipThisOrchestrationStepisActiveMFASessionSkipThisOrchestrationStepnewPhoneNumberEnteredSkipThisOrchestrationStepauthenticationSourcelocalAccountAuthenticationSkipThisOrchestrationStepauthenticationSourcesocialIdpAuthenticationSkipThisOrchestrationStep

public class AuthImpl {
    private static final String TAG = AuthImpl.class.getSimpleName();
    private Activity activity;
    private PublicClientApplication authClient;
    private AuthTokenProvider authTokenProvider;
    private String[] scopes;
    @Inject
    AuthImpl(AppCompatActivity activity, PublicClientApplication authClient, AuthTokenProvider authTokenProvider)
    {
        this.activity = activity;
        this.authClient = authClient;
        this.authTokenProvider = authTokenProvider;
        this.scopes = Constants.SCOPES.split("\\s+");
    }
    public boolean isUserAuthenticated() {
        return AndroidHelpers.isEmulator() || getCurrentUser() != null;
    }
    private User getCurrentUser() {
        try {
            return Helpers.getUserByPolicy(authClient.getUsers(), Constants.SISU_POLICY);
        } catch (MsalClientException e) {
            /* No token in cache, proceed with normal unauthenticated app experience */
            Log.d(TAG, "MSAL Exception Generated while getting users: " + e.toString());
        } catch (IndexOutOfBoundsException e) {
            Log.d(TAG, "User at this position does not exist: " + e.toString());
        }
        return  null;
    }
    public Single login()
    {
        /* Attempt to get a user and acquireTokenSilently
         * If this fails we will do an interactive request
         */
        return Single.create(emitter -> {
            try {
                User currentUser = Helpers.getUserByPolicy(authClient.getUsers(), Constants.SISU_POLICY);
                if (currentUser != null) {
            /* We have 1 user */
                    authClient.acquireTokenSilentAsync(
                            scopes,
                            currentUser,
                            String.format(Constants.AUTHORITY, Constants.TENANT, Constants.SISU_POLICY),
                            false,
                            getAuthSilentCallback(emitter));
                } else {
            /* We have no user */
                    authClient.acquireToken(activity, scopes, getAuthInteractiveCallback(emitter));
                }
            } catch (MsalClientException e) {
        /* No token in cache, proceed with normal unauthenticated app experience */
                Log.d(TAG, "MSAL Exception Generated while getting users: " + e.toString());
            } catch (IndexOutOfBoundsException e) {
                Log.d(TAG, "User at this position does not exist: " + e.toString());
            }
        });
    }
    //
    // App callbacks for MSAL
    // ======================
    // getActivity() - returns activity so we can acquireToken within a callback
    // getAuthSilentCallback() - callback defined to handle acquireTokenSilent() case
    // getAuthInteractiveCallback() - callback defined to handle acquireToken() case
    //
    /* Callback used in for silent acquireToken calls.
     * Looks if tokens are in the cache (refreshes if necessary and if we don't forceRefresh)
     * else errors that we need to do an interactive request.
     */
    private AuthenticationCallback getAuthSilentCallback(final SingleEmitter emitter) {
        return new AuthenticationCallback() {
            @Override
            public void onSuccess(AuthenticationResult authenticationResult) {
                /* Successfully got a token, call api now */
                Log.d(TAG, "Successfully authenticated");
                emitter.onSuccess(new AuthResultDto(authenticationResult.getIdToken()));
            }
            @Override
            public void onError(MsalException exception) {
                /* Failed to acquireToken */
                Log.d(TAG, "Authentication failed: " + exception.toString());
                if (exception instanceof MsalClientException) {
                    /* Exception inside MSAL, more info inside MsalError.java */
                    emitter.onError(exception);
                    assert true;
                } else if (exception instanceof MsalServiceException) {
                    /* Exception when communicating with the STS, likely config issue */
                    emitter.onError(exception);
                    assert true;
                } else if (exception instanceof MsalUiRequiredException) {
                    /* Tokens expired or no session, retry with interactive */
                    authClient.acquireToken(activity, scopes, getAuthInteractiveCallback(emitter));
                }
            }
            @Override
            public void onCancel() {
                /* User canceled the authentication */
                Log.d(TAG, "User cancelled login.");
                emitter.onSuccess(new AuthResultDto(true));
            }
        };
    }
    /* Callback used for interactive request.  If succeeds we use the access
     * token to call the api. Does not check cache.
     */
    private AuthenticationCallback getAuthInteractiveCallback(final SingleEmitter emitter) {
        return new AuthenticationCallback() {
            @Override
            public void onSuccess(AuthenticationResult authenticationResult) {
                /* Successfully got a token, call api now */
                Log.d(TAG, "Successfully authenticated");
                Log.d(TAG, "ID Token: " + authenticationResult.getIdToken());
                authTokenProvider.setAuthToken(authenticationResult.getIdToken());
                emitter.onSuccess(new AuthResultDto(authenticationResult.getIdToken()));
            }
            @Override
            public void onError(MsalException exception) {
                /* Failed to acquireToken */
                Log.d(TAG, "Authentication failed: " + exception.toString());
                if (exception instanceof MsalClientException) {
                    /* Exception inside MSAL, more info inside MsalError.java */
                    emitter.onError(exception);
                    assert true;
                } else if (exception instanceof MsalServiceException) {
                    /* Exception when communicating with the STS, likely config issue */
                    emitter.onError(exception);
                    assert true;
                }
            }
            @Override
            public void onCancel() {
                /* User canceled the authentication */
                Log.d(TAG, "User cancelled login.");
                emitter.onSuccess(new AuthResultDto(true));
            }
        };
    }
    static final int BROWSER_FLOW = 1001;
    boolean handleInteractiveRequestRedirect(int requestCode, int resultCode, final Intent data){
        if(requestCode == BROWSER_FLOW)
        {
            authClient.handleInteractiveRequestRedirect(requestCode, resultCode, data);
            return true;
        }
        return false;
    }
}

 private final FirebaseAuth authInstance;
  private CompositeDisposable disposables;
  private EventSubscriber eventSubscriber;
  public Single login(boolean forceRefreshToken)
    {
        if (disposables != null) {
            disposables.dispose();
        }
        disposables = new CompositeDisposable();
        return Single.create(emitter -> {
            FirebaseUser user = authInstance.getCurrentUser();
            if (user == null || !user.isEmailVerified()) {
                List providers = Arrays.asList(
                        new AuthUI.IdpConfig.EmailBuilder().setRequireName(true).build(),
                        new AuthUI.IdpConfig.GoogleBuilder().build());
                activity.startActivityForResult(
                        AuthUI.getInstance()
                                .createSignInIntentBuilder()
                                .setAvailableProviders(providers)
                                .build(),
                        MainActivity.REQUES_LOGIN);
            } else {
                if (forceRefreshToken) {
                    refreshToken();
                } else {
                    emitter.onSuccess(new AuthResultDto(false));
                }
            }
            disposables.add(this.eventSubscriber.getEvent(new AuthResultDto(true))
                    .subscribe(e ->  {
                        emitter.onSuccess(e);
                        disposables.dispose();
                    }));
        });
    }
    private void refreshToken() {
        FirebaseUser user = authInstance.getCurrentUser();
        user.getIdToken(true)
                .addOnCompleteListener(task -> {
                    if (task.isSuccessful()) {
                        GetTokenResult tokenResult = task.getResult();
                        String idToken = tokenResult.getToken();
                        // Сохраняем idToken
                        eventSubscriber.Publish(new AuthResultDto( false));
                        // ...
                    } else {
                        AuthResultDto result = new AuthResultDto( false);
                        result.Error = new Exception(task.getException());
                        eventSubscriber.Publish(new AuthResultDto(false));
                    }
        });
    }