Errors

SdkError is the SDK’s single error type: code: SdkErrorCode, reason: SdkErrorReason, an optional human-readable errorMessage, and an optional providerError for social-provider failures. It conforms to LocalizedError, and its message is automatically redacted — any embedded JWT or Bearer ... token is replaced with [redacted] before it is ever surfaced to your code or a log.

Two delivery paths — know which one you’re handling

Configuration errors throw synchronously. Constructing an invalid RakomiAuthConfiguration throws an SdkError from the initializer — these are programmer errors and must be caught with ordinary Swift do/catch, not observed on a stream.
Every runtime auth error is emitted, never thrown. RakomiAuth’s async sign-in/session methods never throw for an auth-flow failure; they emit AuthState.error(SdkError) on authStateChanges(). getToken() is one exception — it throws when there is no valid session, so a caller reaching for a token gets a normal Swift error at the call site.

`SdkErrorCode`

The top-level classification. Its wire form (used in logging and cross-platform parity) is the uppercase SCREAMING_SNAKE_CASE shown in the second column.

Case	Wire value
`refreshFailed`	`REFRESH_FAILED`
`oauthCallbackError`	`OAUTH_CALLBACK_ERROR`
`tenantSuspended`	`TENANT_SUSPENDED`
`csrfMismatch`	`CSRF_MISMATCH`
`codeExchangeFailed`	`CODE_EXCHANGE_FAILED`
`signInFailed`	`SIGN_IN_FAILED`
`invalidConfig`	`INVALID_CONFIG`
`networkError`	`NETWORK_ERROR`
`providerError`	`PROVIDER_ERROR`
`biometricError`	`BIOMETRIC_ERROR`
`storageError`	`STORAGE_ERROR`
`rateLimited`	`RATE_LIMITED`
`invalidCredentials`	`INVALID_CREDENTIALS`
`mfaStepUpRequired`	`MFA_STEP_UP_REQUIRED`
`mfaStepUpUnavailable`	`MFA_STEP_UP_UNAVAILABLE`
`unknown`	`UNKNOWN`

`SdkErrorReason`

A discriminating sub-reason, combined with the code above for the full picture. Its wire form is snake_case.

OAuth flow

Case	Wire value
`oauthUserCancelled`	`oauth_user_cancelled`
`oauthLocked`	`oauth_locked`
`oauthStateMismatch`	`oauth_state_mismatch`
`oauthRedirectMismatch`	`oauth_redirect_mismatch`
`oauthMissingParams`	`oauth_missing_params`
`oauthProviderError`	`oauth_provider_error`

Biometric gate

Case	Wire value
`biometricCancelled`	`biometric_cancelled`
`biometricLockout`	`biometric_lockout`
`biometricNotEnrolled`	`biometric_not_enrolled`
`biometricUnavailable`	`biometric_unavailable`

Session lifecycle

Case	Wire value
`sessionExpired`	`session_expired`
`sessionRevoked`	`session_revoked`

Refresh failure detail

Case	Wire value
`refreshExpired`	`refresh_expired`
`refreshRevoked`	`refresh_revoked`
`refreshNetwork`	`refresh_network`

MFA step-up

Case	Wire value
`mfaStepUpRequired`	`mfa_step_up_required`
`mfaStepUpUnavailable`	`mfa_step_up_unavailable`

Validation / format

Case	Wire value
`invalidCredentials`	`invalid_credentials`
`rateLimited`	`rate_limited`

tvOS device authorization (RFC 8628)

Case	Wire value
`deviceCodeAuthorizationPending`	`device_code_authorization_pending`
`deviceCodeSlowDown`	`device_code_slow_down`
`deviceCodeAccessDenied`	`device_code_access_denied`
`deviceCodeExpired`	`device_code_expired`

DPoP-bound refresh (RFC 9449, opt-in — see Session & tokens)

Case	Wire value	Meaning
`dpopProverUnavailable`	`dpop_prover_unavailable`	The device could not produce a proof (transient) — the session is kept, no proof-less request was made.
`invalidDpopProof`	`invalid_dpop_proof`	The server rejected the proof — the session is cleared; re-authenticate to bind a fresh key.
`invalidRefreshToken`	`invalid_refresh_token`	The refresh token itself was rejected — the session is cleared.

Generic

Case	Wire value
`network`	`network`
`unknown`	`unknown`

Reading a redacted message

case .error(let sdkError):
    print(sdkError.errorDescription)
    // "SdkError(code=SIGN_IN_FAILED, reason=invalid_credentials, message=...)"

errorDescription and redactedMessage never contain a raw JWT or Authorization header value — even one embedded mid-string in a wrapped provider error is scrubbed before it reaches your code.

Next steps

Authentication — the flows that can emit these.
Session & tokens — refresh and offline-verification error paths.