On-device authentication edge case

Archived
1

Documentation for on-device authentication is here:

On-device authentication

It states:

Additionally, once a customer authenticates on one device, they can automatically be signed in when they activate additional Roku devices linked to their same Roku account.

I have a question about an edge case. Consider the following scenario:

  1. User installs publisher app on Roku device
  2. User creates a publisher account (an account specific to the app)
  3. Publisher app stores credentials in registry and cloud
  4. User buys a second Roku device
  5. On the second device, user logs into the same Roku account used for the first device
  6. User installs publisher app
  7. User is automatically logged in to the publisher account using credentials in the cloud
  8. User logs out of publisher account on second device (this is where it gets interesting)
  9. User creates a second publisher account on second device
  10. Publisher app stores credentials in registry (on second device) and on the cloud

(sorry for so many steps)

At this point, the cloud has credentials for the second publisher account and not the first publisher account. If the user logs out of their publisher account on the first device or if the credentials in the registry expire, the next time the publisher app is loaded, it will pull what’s in the cloud, which in this case is the second publisher account; the user will be logged in with their second publisher account.

Is behavior expected/acceptable? I could imagine it being a slightly jarring experience for the user for the app to log them into their second account on a device where they were logged out, especially if it were due to expired credentials and not explicitly logging out.

The only way I can think of to prevent the above scenario is to prevent the user from creating a second publisher account by only allowing one publisher account to be associated with one Roku account.

Thank you for any thoughts or feedback.