Agent skill · software engineering · dpearson2699
authentication
Implement iOS authentication flows with AuthenticationServices and LocalAuthentication. Use when building Sign in with Apple, passkey/WebAuthn registration or sign-in with ASAuthorizationPlatformPublicKeyCredentialProvider, ASAuthorizationController credential state and revocation handling, ASWebAuthenticationSession OAuth or third-party login, Password AutoFill, identity-token server validation, or local biometric re-authentication with LAContext.
Why this skill is useful
Provides specific implementation patterns and code snippets for iOS authentication flows that the AI wouldn't reliably generate on its own.
What it needs
Requires xcode installed locally. About 6k tokens when loaded. Last updated 2026-07-31. 973 stars on the source repository.
What this skill does
Authentication Implement authentication flows on iOS using the AuthenticationServices framework, including Sign in with Apple, passkeys, OAuth/third-party web auth, Password AutoFill, and biometric re-authentication. Contents Sign in with Apple Credential Handling Credential State Checking Token Validation Existing Account Setup Flows Passkeys ASWebAuthenticationSession (OAuth) Password AutoFill Credentials Biometric Authentication Security Boundaries SwiftUI SignInWithAppleButton Common Mistakes Review Checklist References Sign in with Apple Add the "Sign in with Apple" capability in Xcode before using these APIs. UIKit: ASAuthorizationController Setup Delegate: Handling Success and Failure Credential Handling Credential data Required handling --- --- user Persist this stable, per-team identifier for credential-state checks. email, fullName These optional values arrive only on first authorization; cache them immediately. identityToken, authorizationCode Send them to the server for validation or exchange; never trust them as client-side proof. Treat realUserStatus only as a fraud-prevention signal, not authentication proof. Credential State Checking Check credential state on every app launch. The user may revoke access at any time via Settings > Apple Account > Sign-In & Security. Credential Revocation Notification Token Validation The identityToken is a JWT. Send it to your server for validation -- never trust it client-side alone. Server-side, validate the JWT against Apple's public keys at https://appleid.apple.com/auth/keys (JWKS). Verify: iss is https://appleid.apple.com, aud matches your bundle ID, and exp has not passed. Exchange the short-lived authorization code on the server and store the resulting app session token in Keychain. Existing Account Setup Flows On launch, silently check for existing Sign in with Apple and password credentials before showing a login screen: Call this in viewDidAppear or on app launch. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dpearson2699/authentication