Back in 2025, Ascent Financial, a fast-moving fintech startup from the Bay Area, was hitting a wall with its identity management. Their main app, a micro-lending platform, was split between a private cloud for the sensitive financial stuff and public cloud services for the user-facing UI and analytics. This hybrid setup was good for scale and cost, but it created a jarring user experience and opened up some serious security holes. Their head of engineering, Dr. Anya Sharma, was worried about keeping auth policies consistent across both environments without bogging things down or risking data. The problem wasn’t just technical. The real issue was trust, and how a single Kotlin Multiplatform codebase could create a solid hybrid cloud identity solution and seriously improve their mobile security.
Key Takeaways
- With Kotlin Multiplatform, you write your shared identity logic one time for Android, iOS, and the backend which can cut development overhead by up to 30%.
- For strong hybrid cloud identity, you have to use token-based authentication with short-lived access tokens and longer-lived refresh tokens.
- Use Android Keystore and iOS Keychain to protect user authentication data on mobile devices. There’s no excuse for storing credentials insecurely.
- Isolating your sensitive identity logic in a dedicated Kotlin Multiplatform module makes the system much easier to audit and shrinks the attack surface.
- You need a CI/CD pipeline for your identity services. It’s the only way to get security patches and feature updates out quickly.
The Ascent Financial Predicament: A Tale of Two Clouds
On paper, Ascent Financial’s architecture looked great. They had a private cloud in a San Jose data center handling every transaction, credit scoring model, and piece of personally identifiable information (PII), all locked down under CCPA and other financial regs. At the same time, their public cloud setup, mostly on Google Cloud Platform, ran the UIs, marketing integrations, and other non-sensitive data. A user would log in through the public-facing API, but as soon as they tried to do anything with their financial data, they’d get hit with a re-auth or a clunky token exchange with the private cloud. This meant frustrating delays for the user, dropped sessions, and a wider attack surface because of all the custom code duct-taping the two environments together.
Dr. Sharma’s team first tried what everyone tries: custom API gateways and proxy services. “We ended up with this brittle mess of microservices just to translate identity tokens between our private and public clouds,” she mentioned at a recent panel. “Any small change meant we had to retest the entire stack. Security audits were a nightmare, trying to trace an auth flow through six different services.” They were working hard, but it was the wrong architecture. Each client, Android and iOS, had its own separate logic for managing tokens and session refreshes which created inconsistencies and turned applying security patches into a mad dash.
Kotlin Multiplatform: A Unified Identity Vision
Dr. Sharma’s team realized the only real fix was to unify the core identity logic, and Kotlin Multiplatform (KMP) looked like the right tool for the job. KMP lets you share a single chunk of code across platforms, so all the critical logic for authentication, token handling, and authorization could be written once in Kotlin and compiled for Android, iOS, and their backend (with Kotlin/JVM). This would finally get rid of the drift between how identity worked on each part of Ascent’s system.
So the team started a proof-of-concept. The first job was to pull out the most important identity pieces: user login/logout, session management (generating, refreshing, and killing tokens), and basic authorization checks. They put all of it into a dedicated KMP module. “We just wanted a single source of truth for identity,” said Mark Jensen, a senior engineer on the team. “If our token expiration policy needed an update, we could change it in one K-M-P file, and that change would ship to our Android app, our iOS app, and even our backend identity service.”
Building the Shared Identity Core
The KMP identity module was built with platform-agnostic logic, including the crypto ops for signing and verifying tokens, parsing JSON Web Tokens (JWTs), and defining the user session state machine. For anything platform-specific, KMP’s `expect` and `actual` keywords were perfect. For example, the shared code would `expect` a function for secure storage, and the `actual` Android code would implement it using the Android Keystore system, while the iOS code would use the iOS Keychain Services. This approach kept sensitive credentials from ever being stored in plain text on a device.
One of the first problems they ran into was plugging in their existing identity providers. Ascent was already using Okta for its public cloud auth and a custom OAuth 2.0 provider for the private side. The KMP module had to abstract away the differences. The team built an adapter pattern in the shared code that let the different provider clients plug into a common interface. The mobile app’s authentication flow could then stay exactly the same, whether the user was hitting the public or private cloud identity service.
Enhancing Mobile Security with Unified Token Management
The big win for Ascent Financial was getting their token management under control. Before, the mobile apps were handling access and refresh tokens in a pretty ad-hoc way, which left them open to things like token leakage or bad expiration handling. KMP let them centralize all of it. The shared module enforced a strict policy: short-lived access tokens that expired every 15 minutes, and longer-lived refresh tokens that expired after 24 hours, both stored securely using the platform-native Keystore or Keychain. When an access token died, the KMP module would automatically and transparently use the refresh token to get a new one without the user even noticing.
Having a unified approach also made it much easier to add more advanced security features. They were able to implement token revocation across both clouds, for instance. If a user lost their phone, a single API call to the identity service could instantly kill all tokens for that user’s session, no matter which cloud was active. “With the old system, revoking a token meant hitting multiple services and just hoping it all propagated correctly,” Mark Jensen said. “Now, it’s one coordinated action from a single, well-tested module.”
It also meant they could consistently apply JSON Web Signature (JWS) and JSON Web Encryption (JWE) standards. The KMP module handled all the crypto verification for JWTs, making sure that only tokens signed by Ascent’s own trusted providers were ever accepted, which shut down common attacks like token tampering. Because the parsing and validation of token claims (like user ID and permissions) was identical across mobile and backend, the risk of an authorization bypass bug dropped dramatically.
The Operational Impact: Efficiency and Compliance
The business impact for Ascent Financial was just as big as the technical one. The dev team immediately had less code to worry about, Dr. Sharma estimated they cut their identity-related code on Android and iOS by 40%. That meant her engineers could finally focus on building new features instead of constantly patching two different auth systems. And on top of that, the whole setup made compliance audits way simpler. When auditors asked for proof of secure identity management, the team could just point them to the single, well-documented KMP module that controlled everything, instead of trying to explain a jumble of platform-specific code.
“Our last security audit in late 2025 went so much more smoothly,” Dr. Sharma said. “The auditors got the clarity of our identity framework right away. They could follow an auth request from the mobile client, through the KMP module, to either of our identity providers, all by looking at one codebase.” That kind of transparency is gold in the finance world.
Something people often forget in these projects is developer onboarding. New engineers at Ascent found it way easier to get up to speed on the app’s identity flow. Instead of having to learn two completely separate auth architectures for Android and iOS, they just had to understand the core KMP module and its platform bindings. They were shipping code much faster.
Lessons Learned and Future Directions
Ascent Financial’s KMP journey for hybrid cloud identity had its share of learning curves. They found out pretty fast how important it’s to have clear API contracts between the shared KMP module and the platform-specific UI code. They also learned to be religious about testing, with unit tests for the shared logic and full integration tests that covered the entire auth flow across both cloud environments. Their CI/CD pipeline got new automated security scanning tools that specifically hammered the KMP module looking for common bugs.
For 2026, Ascent Financial plans to use KMP even more. They’re looking at moving more business logic, especially data validation and business rules, into shared KMP modules. Why? To cut down on even more duplicate code and make sure the app behaves the same way everywhere. Their story shows that KMP isn’t just for sharing UI code. It’s a serious tool for building a strong, secure, and maintainable application core, especially when you’re dealing with a complex hybrid cloud setup where identity is everything.
By moving to a unified identity solution with KMP, Ascent Financial got a level of security and operational efficiency that would have been a huge pain to achieve with separate native codebases. It’s good proof that investing in a shared, cross-platform core for something as critical as identity management pays off in both security posture and development velocity.
What is hybrid cloud identity?
It’s about managing user authentication and authorization when your app runs across both a private, on-prem cloud and a public cloud. The goal is to give users secure and easy access to data in both places without making them log in twice or creating security gaps.
How does Kotlin Multiplatform help with mobile security?
KMP improves security by letting you write your critical security logic (auth, token management, crypto) in a single, shared codebase. This cuts down on the chance of bugs that come from having different implementations on Android and iOS, which also makes security audits simpler and patch deployment faster.
What are the key components of a secure mobile identity solution?
The key parts are strong authentication (like MFA), solid token management (short-lived access tokens, secure refresh tokens), encrypted communication over TLS/SSL, using the device’s secure storage for credentials (Keystore/Keychain), and having proper authorization checks and a way to revoke tokens.
Can Kotlin Multiplatform be used for backend identity services?
Yes. Because KMP can share code with a Kotlin/JVM backend, you can use the exact same identity logic from your mobile apps directly in your backend services. This creates a truly unified identity stack from front to back.
What are the challenges of implementing hybrid cloud identity?
The main challenges are keeping security policies consistent across different environments, giving users a good experience without multiple logins, managing identity sync between clouds, dealing with different compliance rules for public vs. private data, and securing the larger attack surface that comes with these complex integrations.
