Kotlin does not really fit in that context. It is just syntactic sure on top of Java and will compile to native Android Java Bytecode. So it's the exact same thing just with some different syntax basically. And it is already used in production apps and will surely gain more traction even with the big players

I normally think of the tools and steps needed for my problem and then Google the exact method names or how they should be used. I think in some cases where you have a problem that's unique to your app, it makes sense to try it out yourself, but as a reasonably experience developer it mainly costs time, since you'll most likely be familiar with the general concept and are just looking for the best solution in terms of performance or readability. Also, I'm pretty sure that when I first started out, I did a lot of things without knowing how they work, but it was fun and that kept me learning and eventually I figured out what I was doing. If I had tried to understand everything and not just googled for things of all kinds, I'm sure I'd have quit programming long ago.

Session or local storage is what I use nowadays. You need to take measures against csrf when using cookies, but local storage is only accessible for your JavaScript so as far as I understood the documentation of multiple auth providers it is not necessary in the case that you don't use cookies for any sensitive data. You still need to watch out for people inserting malicious js into your app of course.

APIs would be awesome, I'd love to create an Android App for Hashnode.