Swift: Authentication

#SovariaAuth.currentSession

A property.

public var currentSession: Session?

#SovariaAuth.passkeys

Passkeys (WebAuthn): add one for the signed-in user, sign in with one, list and remove them.

public var passkeys: SovariaPasskeys

#SovariaAuth.changes

Emits sign-in / refresh / sign-out events (for updating UI).

public var changes: AsyncStream<AuthState>

Each new listener first gets .initialSession with the current session (nil when signed out), as in the Dart and TypeScript clients.

#SovariaAuth.restoreSession

public func restoreSession() async throws -> Session?

#SovariaAuth.currentAccessToken

The token to sign requests with: the session's (refreshed first when near expiry) or nil.

public func currentAccessToken() async -> String?

#SovariaAuth.refreshSession

public func refreshSession(silent: Bool = false) async throws -> Session?

#SovariaAuth.signUp

public func signUp(email: String, password: String, name: String = "") async throws -> [String: Any]

HTTP

POST /api/v1/auth/register

#SovariaAuth.signInWithPassword

public func signInWithPassword(email: String, password: String, captchaToken: String? = nil) async throws -> Session

HTTP

POST /api/v1/auth/project/login

#SovariaAuth.signInAnonymously

public func signInAnonymously() async throws -> Session

HTTP

POST /api/v1/auth/project/anonymous

#SovariaAuth.verifyMfa

public func verifyMfa(_ code: String, method: String = "") async throws -> Session

HTTP

POST /api/v1/auth/mfa/verify

#SovariaAuth.sendSmsOtp

public func sendSmsOtp(_ phone: String) async throws

HTTP

POST /api/v1/auth/otp/send

#SovariaAuth.verifySmsOtp

public func verifySmsOtp(phone: String, code: String) async throws -> Session

HTTP

POST /api/v1/auth/otp/verify

#SovariaAuth.sendMagicLink

Email a sign-in link plus a 6-digit code.

public func sendMagicLink(_ email: String, redirectTo: String? = nil, pkce: Bool? = nil, captchaToken: String? = nil) async throws

A link that opens your app (redirectTo with your app's scheme, or a universal link with pkce: true) is bound to this install with PKCE.

HTTP

POST /api/v1/auth/magic-link/send

#SovariaAuth.verifyMagicLink

Sign in with the token from a magic link (usually through handleDeepLink).

public func verifyMagicLink(_ token: String, codeVerifier: String? = nil) async throws -> Session

HTTP

POST /api/v1/auth/magic-link/verify

#SovariaAuth.verifyEmailCode

public func verifyEmailCode(email: String, code: String) async throws -> Session

HTTP

POST /api/v1/auth/magic-link/verify-code

#SovariaAuth.resetPasswordForEmail

Email a password-reset link (PKCE-bound when it opens your app).

public func resetPasswordForEmail(_ email: String, redirectTo: String? = nil, pkce: Bool? = nil) async throws

HTTP

POST /api/v1/auth/password-reset/send

#SovariaAuth.confirmPasswordReset

Set the new password with the token from a type=recovery link.

public func confirmPasswordReset(token: String, newPassword: String, codeVerifier: String? = nil) async throws

HTTP

POST /api/v1/auth/password-reset/confirm

#SovariaAuth.handleDeepLink

Handle a deep link / universal link that opened the app: provider sign-in (type=sso), magic links, email confirmations; for recovery the token is returned for the new-password screen.

public func handleDeepLink(_ url: URL) async throws -> AuthLinkResult?

Returns nil when the link isn't an auth link. Call it from onOpenURL / application(_:open:).

#SovariaAuth.getOAuthSignInURL

Where the OAuth sign-in should take the user (an app scheme such as com.acme.app://callback, or a web URL).

public func getOAuthSignInURL(_ provider: String, redirectTo: String? = nil) async throws -> OAuthStart

Asks for the JSON answer (the route redirects otherwise) and starts PKCE: the verifier is kept in the session storage until exchangeCodeForSession (audit SDK2-M2).

HTTP

GET /api/v1/auth/sso/{provider_id}/authorize

#SovariaAuth.exchangeCodeForSession

Finish an OAuth sign-in with the code from the redirect.

public func exchangeCodeForSession(_ code: String, codeVerifier: String? = nil) async throws -> Session

The PKCE verifier saved by getOAuthSignInURL is used when none is passed.

HTTP

POST /api/v1/auth/sso/exchange

#SovariaAuth.listProviders

public func listProviders() async throws -> [[String: Any]]

HTTP

GET /api/v1/auth/sso/providers

#SovariaAuth.getUser

public func getUser() async throws -> [String: Any]

HTTP

GET /api/v1/auth/me

#SovariaAuth.listDevices

public func listDevices() async throws -> [[String: Any]]

HTTP

GET /api/v1/auth/devices

#SovariaAuth.signOut

public func signOut() async throws

HTTP

POST /api/v1/auth/logout

#AuthState.event

A property.

public let event: AuthEvent

#AuthState.session

A property.

public let session: Session?

#AuthLinkResult.type

A property.

public let type: String

#AuthLinkResult.session

A property.

public let session: Session?

#AuthLinkResult.token

A property.

public let token: String?

#AuthLinkResult.error

A property.

public let error: String?

#AuthLinkResult.errorDescription

A property.

public let errorDescription: String?

#OAuthStart.url

A property.

public let url: String

#OAuthStart.codeVerifier

A property.

public let codeVerifier: String?

#SovariaPasskeys.startRegistration

Registration options (WebAuthn JSON) for a new passkey for the signed-in user.

public func startRegistration(name: String = "") async throws -> [String: Any]

HTTP

POST /api/v1/auth/passkeys/register/start

#SovariaPasskeys.finishRegistration

Save the passkey the authenticator created (its WebAuthn JSON).

public func finishRegistration(credential: [String: Any], name: String = "") async throws -> [String: Any]

HTTP

POST /api/v1/auth/passkeys/register/finish

#SovariaPasskeys.startSignIn

Sign-in options.

public func startSignIn(userId: String? = nil) async throws -> SignInStart

Pass userId to offer only that user's passkeys.

HTTP

POST /api/v1/auth/passkeys/authenticate/start

#SovariaPasskeys.finishSignIn

Verify the signed challenge and sign the user in (two-factor when the device checked the user).

public func finishSignIn(challengeId: String, credential: [String: Any]) async throws -> Session

HTTP

POST /api/v1/auth/passkeys/authenticate/finish

#SovariaPasskeys.list

The signed-in user's passkeys: id, name, created_at, last_used_at.

public func list() async throws -> [[String: Any]]

HTTP

GET /api/v1/auth/passkeys

#SovariaPasskeys.remove

Remove one of the signed-in user's passkeys.

public func remove(_ passkeyId: String) async throws

HTTP

DELETE /api/v1/auth/passkeys/{passkey_id}

#SignInStart.challengeId

A property.

public let challengeId: String

#SignInStart.options

A property.

public let options: [String: Any]

#Session.accessToken

A property.

public let accessToken: String

#Session.refreshToken

A property.

public let refreshToken: String

#Session.expiresAt

A property.

public let expiresAt: Date

#Session.raw

The full token response (actor lane, MFA flags, …), minus the refresh token.

public let raw: [String: Any]

#Session.Session.init

Create an instance.

public init(accessToken: String, refreshToken: String, expiresAt: Date, raw: [String: Any] = [:])

#Session.userId

The user id (sub of the access token).

public var userId: String?

#Session.claims

The access token's claims (not verified here; the server verifies on every request).

public var claims: [String: Any]

#Session.expiresWithin

public func expiresWithin(_ margin: TimeInterval, now: Date = Date()) -> Bool

#SessionStorage.read

func read(_ key: String) async -> String?

#SessionStorage.write

func write(_ key: String, _ value: String) async

#SessionStorage.delete

func delete(_ key: String) async

#MemorySessionStorage.MemorySessionStorage.init

Create an instance.

public init()

#MemorySessionStorage.read

public func read(_ key: String) async -> String?

#MemorySessionStorage.write

public func write(_ key: String, _ value: String) async

#MemorySessionStorage.delete

public func delete(_ key: String) async

#SovariaDevice.id

A property.

public let id: String

#SovariaDevice.platform

A property.

public let platform: String

#SovariaDevice.name

A property.

public let name: String

#SovariaDevice.SovariaDevice.init

Create an instance.

public init(id: String, platform: String, name: String = "")

#Pkce.verifier

A property.

public let verifier: String

#Pkce.challenge

A property.

public let challenge: String

#Pkce.generate

A fresh pair from 32 random bytes (a 43-character verifier).

public static func generate() -> Pkce

#Pkce.challengeFor

BASE64URL(SHA-256(verifier)) without padding.

public static func challengeFor(_ verifier: String) -> String