Right now the safest way to test this is to invalidate all the tokens before testing this. This should be fixed in MDL-56905 . Configure a https 3.2 site (like qa.moodle.net) to use login via browser or embed browser. To do so, as admin go to Site administration > Mobile app > Mobile authentication. Install the app in a device. Please make sure you aren't logged in in the site in the device's browser. In the app, add the site so a browser or embed browser is opened. Authenticate in the browser and check that you're redirected and authenticated in the app. There are 2 ways to validate that everything worked fine: Open Console and check that this code returns a token: var $mmSite = angular.element(document.querySelector('[ng-app]')).injector().get('$mmSite'); $mmSite.getPrivateToken() First of all, logout in your device's browser. Then in the app, open side menu and click "Website". Verify that you're authenticated in the site when it's opened in the browser.