FAQs About Integrating HMS Core Account Kit - Huawei Developers

Account Kit provides simple, secure, and quick sign-in and authorization functions. Rather than having users enter accounts and passwords and wait for authentication, you can let your users simply tap Sign in with HUAWEI ID to quickly and securely sign in to an app with their HUAWEI IDs.
And this is the very reason why I integrated this kit into my app. While doing so, I encountered and collated some common issues related to this kit, as well as their solutions, which are all listed below. I hope you find this helpful.
1. What is redirect_url and how to configure it?​redirect_url, or redirection URL, is not the real URL of a specific webpage. Its value is a character string starting with https://. Although it can be customized to whatever you want, you are advised to assign a meaningful value to this parameter according to your service's features.
According to OAuth 2.0, in a web app, redirect_url works in the following scenario: After obtaining user authorization from the OAuth server, the web app will jump to the redirection URL. The web app needs to obtain the authorization code through the URL. To obtain an access token, pass the URL as a parameter to the request that will be sent to the OAuth server. Then, the server will check whether the URL matches the authorization code. If so, the server will return an access token, but if it doesn't, it will return an error code instead.
Check out the instructions in Account Kit's documentation to learn how to set a redirection URL.
2. What's the difference between OpenID and UnionID?​An OpenID uniquely identifies a user in an app, but it differs for the same user in different apps.
A UnionID uniquely identifies a user across all apps created under the same developer account.
Specifically speaking, after a user uses their HUAWEI ID to sign in to your apps that have integrated Account Kit, the apps will obtain the OpenIDs and UnionIDs of that user. The OpenIDs are different, but the UnionIDs are the same. In other words, if you adopt the OpenID to identify users of your apps, a single user will be identified as different users across your apps. However, the UnionID for a single user does not change. Therefore, if you want to uniquely identify a user across your apps, the UnionID is advised. Note that if you transfer one of your apps from one developer account to another, the UnionID will also change.
3. How do I know whether an account has been used to sign in to an app?​To know this, you can call the style='mso-bidi-font-weight:normal'>silentSignIn API. If the value of the returned style='mso-bidi-font-weight:normal'>authAccount object in style='mso-bidi-font-weight:normal'>onSuccess is not null, this indicates that the account has been used to sign in to an app.
Code:
Task<AuthAccount> task = service.silentSignIn();
task.addOnSuccessListener(new OnSuccessListener<AuthAccount>() {
@Override
public void onSuccess(AuthAccount authAccount) {
if(null != authAccount) {
showLog("success ");
}
}
});
4. What to do when error invalid session is reported after the user.getTokenInfo API is called?​1. Check whether all input parameters are valid.
2. Confirm that the access_token parameter in the request body has been converted through URL encoding before it is added to the request. Otherwise, if the parameter contains special characters, invalid session will be reported during parameter parsing.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click here to know more details about this API.
5. Is redirect_uri a mandatory parameter in the API for obtaining an access token?​Whether this parameter is mandatory depends on the usage scenarios of the API. Specifically speaking:
The parameter is mandatory, when the API is called to obtain the access token, refresh token, and ID token through the authorization code that has been obtained.
The parameter is not mandatory when a refresh token is used to obtain a new access token.
Check out the official instructions for this API to learn more.
6. How long is the validity of an authorization code, an access token, and a refresh token?​Authorization code: valid for 5 minutes. This code can be used only once.
Access token: valid for 1 hour.
Refresh token: valid for 180 days.
7. Common result codes and their solutions​907135700​This code indicates a failure to call the gateway to query scopes of the app.
To solve it, try the following solutions:
1. Check whether the device can connect to the Internet as normal. If not, this could be because the network connection is unavailable and the network connection does not allow for accessing the site for downloading scopes, due to reasons such as firewall restriction.
2. Check whether the app has been created in AppGallery Connect.
3. Check whether the system time of the device is set to the current time. If not, the device SSL certificate will expire, which will prevent the scopes from being downloaded.
907135701​This code indicates that scopes are not configured on OpenGW, which may be due to the insufficient application of services for the app and inconsistent environment settings.
To solve this error, try the following solutions:
1. Verify that the app has been created in AppGallery Connect.
2. Check whether the app ID in agconnect-services.json is the same as the app ID in AppGallery Connect.
3. Check whether agconnect-services.json is placed under the app directory, as shown in the following figure.
4. Check whether the environments set for your app and HMS Core (APK) are the same, for example, whether they are all the live-network environment or testing environment.
907135702​This code indicates that no certificate fingerprint is configured on OpenGW. To solve this, try the following solutions:
1. Verify that the app has been created in AppGallery Connect.
2. Verify that the SHA-256 certificate fingerprint has been configured in AppGallery Connect. Click here to learn how.
6003​This code indicates certificate fingerprint verification failed.
Verify that the certificate fingerprint in your app's APK file is consistent with that configured in AppGallery Connect, by following the steps below:
1. Open the APK file of your app, extract the META-INF directory from the file, obtain the CERT.RSA file in the directory, and run the keytool -printcert -file META-INF/CERT.RSA command to get the signing certificate information.
2. Sign in to AppGallery Connect, click My projects, and select the project you want to check. On the displayed page, select the app, go to Project settings > General information, and check whether the value in SHA-256 certificate fingerprint is the same as that in the previous step.
Click here to learn more about certificate fingerprint configuration.
References​HMS Core Account Kit Overview
HMS Core Account Kit Development Guide