I work on an Android app which is only used by customers. Anyone can download the app from the Play Store but if they don't have credentials then they will just see a login screen and won't be able to get past that. (Registration process is handled separately and not in the app.) My app uses multiple open source libraries and I will have a button which opens the list of open source licenses. Ideally I don't want to have to add this button to the login screen as it has a fairly clean design. Is it acceptable to add the button to my app's "about" screen which is only accessible post-authentication? This will however mean that people who are not customers will not be able to access this license information, but there would be nothing they could do with the app anyway. Are there some precedents here with how other major apps have approached this?
The intent of most open source licenses is that you have to at least attribute the various open source components you are using. This attribution is due whenever an end user receives your app, even if they are not logged in. For example, the Apache License 2.0 is quite clear:
You must give any other recipients of the Work or Derivative Works a copy of this License
Your app includes the Apache-covered Work, thus the end user who has downloaded your app is a recipient of this Work even if they're not logged in.
It might be sufficient to provides these notices and licenses in documentation for your app, for example by linking it from the app description in whatever app store you use. But I'm not necessarily convinced that this would always be compliant with all open source licenses. Including these notices directly with each copy of the app, and making them accessible to the typical user without any hurdles, is the safest path towards license compliance.