Swift SDK

Intended purpose & user: RakomiSDK is a native Swift SDK for app developers integrating Rakomi authentication directly into iOS, macOS, tvOS, watchOS, or visionOS apps — sign-in, session management, and token handling, with pre-built SwiftUI views and a UIKit/AppKit bridge for apps that are not SwiftUI-first.

Quickstart

import SwiftUI
import RakomiSDK

@main
struct DemoApp: App {
    var body: some Scene {
        WindowGroup {
            ContentView()
                .rakomi(configuration: try! RakomiAuthConfiguration(
                    publishableKey: "pk_test_acme",
                    redirectURI: URL(string: "myapp://callback")!
                ))
        }
    }
}

struct ContentView: View {
    var body: some View {
        RakomiAuthGate(
            signedIn: { user in RakomiUserAvatar() },
            signedOut: { RakomiSignInForm() }
        )
    }
}

See Installation for adding the package, and Configuration for every RakomiAuthConfiguration field.

Platform support

Platform	Minimum deployment target	Interactive sign-in
iOS	16.0	Yes — system browser (PKCE)
macOS	13.0	Yes — system browser (PKCE)
tvOS	16.0	Yes — device authorization grant (no system browser on tvOS)
visionOS	1.0	Yes — system browser (PKCE)
watchOS	9.0	No. The package links and compiles for watchOS, but ships no interactive sign-in flow — `ASWebAuthenticationSession` is unavailable on watchOS, and the biometric gate reports unavailable there unconditionally. A watchOS app can link the SDK; authentication is carried out on a paired device.

The pre-built SwiftUI views (RakomiAuthGate, RakomiSignInForm, RakomiProvider, and the rest — see Authentication) require a higher platform floor than the package itself: iOS 17 / macOS 14 / watchOS 10 / tvOS 17 / visionOS 1, because they use Swift’s @Observable macro. An app deploying to iOS 16 can still use the core RakomiAuth actor and the UIKit/AppKit NotificationCenter bridge; the SwiftUI views become available once the app’s own deployment target reaches iOS 17.

Swift tools version: 5.10. Distribution: Swift Package Manager only — no CocoaPods, no Carthage. Runtime dependencies: zero — the entire surface is built on Apple’s own frameworks (AuthenticationServices, LocalAuthentication, CryptoKit, Security, Network, BackgroundTasks) and the Swift standard library.

Design principles

Zero third-party runtime dependencies — every security-relevant primitive (CSPRNG, SHA-256, Keychain storage, RS256 verification, the system browser) comes from an Apple framework.
Open standards — OAuth 2.0 with PKCE (RFC 7636, S256 only), the system-browser pattern for native apps (RFC 8252), the device authorization grant for TV (RFC 8628), and DPoP-bound refresh tokens (RFC 9449) as an opt-in.
Swift concurrency-native — the auth state machine is an actor; state and events are exposed as AsyncStreams, never as delegate callbacks or completion handlers.
Bearer tokens only — no cookies, no CSRF surface in the SDK itself.
SwiftUI-first, UIKit/AppKit-compatible — pre-built SwiftUI views cover the common flows; a NotificationCenter bridge (RakomiAuthUIKitObserver) is available for UIKit/AppKit apps.

API surface

Area	Reference
Adding the package	Installation
Sign-in, sign-out, social, MFA, device-code, SwiftUI views	Authentication
`AuthState`, `AuthEvent`, token storage and refresh	Session & tokens
`RakomiAuthConfiguration` fields and validation	Configuration
`SdkErrorCode` / `SdkErrorReason`	Errors
Vulnerability disclosure, scope, threat model	Security

Multi-tenant & standards posture

Tenant binding lives in the JWT tenant_id claim, not in OAuth scope strings — multi-tenant clients pass their tenant via the publishableKey on RakomiAuthConfiguration, and the API server enforces isolation server-side. The SDK issues OAuth 2.0 access tokens, RS256-signed; access tokens live roughly 15 minutes and refresh tokens roughly 7 days.

Server-side / Node.js

Verifying tokens in a backend? See the Node SDK.

REST API

Integrating from any language directly? See the REST quickstart.