[workos-tars]

Summary

• Replace the internal implementation inventory with an Android-focused PublicClient/PKCE quickstart, requirements, an explicit no-API-key warning, and links to the full sign-in tutorial and API reference. Require Android 8.0 / API 26 because the published PKCE helper uses java.util.Base64; do not advertise unverified API 24 compatibility.
• Correct the install dependency to 0.2.1, verified against Maven Central and the latest GitHub release. The 0.3.0 version on main is not the current published release.
• Remove stale pre-release/helper coverage claims and server-side API-key examples. Contributor instructions remain in CONTRIBUTING.md; update the build comment's README section reference.

The docs website syncs this README. Merge this source correction before the companion workos/workos docs update so subsequent syncs preserve the fix.

Related: DOC-585

Validation

• ./gradlew ktlintCheck with JDK 17: passed.
• Extracted both quickstart snippets into a disposable Kotlin 2.4/JDK 17 project and compiled against the published com.workos:workos-android:0.2.1 artifact: passed. No authentication requests were made.
• git diff --check: passed.
• Gradle emits an existing deprecation warning for wrapper version 8.14; no build configuration or runtime behavior changed.

Requested by maria@workos.com in Linear (TARS chain)

[linear-code]

DOC-585

[greptile-apps]

Greptile Summary

Replaces the implementation-oriented README with an Android-focused AuthKit PKCE quickstart centered on PublicClient. The documentation now:

• Warns against embedding API keys or client secrets in Android applications.
• Documents the published 0.2.1 dependency and API level 26 requirement.
• Covers redirect URI setup, verifier/state persistence, callback validation, token storage, and cleanup.
• Updates the build-file comment to reference the renamed README section.

The API level 26 requirement fully addresses the previous compatibility finding, and that thread is resolved.

Confidence Score: 5/5

The documentation-only PR appears safe to merge, with the previously reported API-level incompatibility fully addressed.

The README now requires API level 26, matching the availability of the PKCE implementation's Java Base64 API, and no new correctness, security, or repository-rule issues were identified.

Important Files Changed

Filename	Overview
README.md	Replaces internal implementation details with a secure PublicClient/PKCE Android quickstart and raises the documented minimum to API level 26.
build.gradle.kts	Updates a comment to point to the README's new Requirements section without changing build behavior.

Sequence Diagram

sequenceDiagram
    participant App as Android app
    participant AuthKit
    participant API as WorkOS API
    App->>App: Generate and persist verifier + state
    App->>AuthKit: Open authorization URL with PKCE challenge
    AuthKit-->>App: Redirect with code + state
    App->>App: Validate returned state
    App->>API: Exchange code with saved verifier
    API-->>App: Return authentication result
    App->>App: Clear pending verifier + state

Loading

_{Reviews (2): Last reviewed commit: "docs: Require API 26 for the PKCE quicks..." | Re-trigger Greptile}

[workos-tars]

Companion docs PR: https://github.com/workos/workos/pull/71772. It regenerates the README copy, fixes the shared install snippet, removes the duplicate installation section, and adds an HTML/Markdown regression check. Merge this source README PR first so future syncs preserve the correction.