auth0/auth0.swift

459 stars Quality 42 Trend 42

A new major version 3.0.0 of Auth0.swift is now available as GA. It includes breaking changes and improvements over v2. We'd love for you to try it out and share your feedback!

Overview

A new major version 3.0.0 of Auth0.swift is now available as GA. It includes breaking changes and improvements over v2. We'd love for you to try it out and share your feedback!

README

📚 Documentation • 🚀 Getting Started • 💡 Examples • 📃 Support Policy • 💬 Feedback

[!IMPORTANT] 🚀 v3 GA Available A new major version 3.0.0 of Auth0.swift is now available as GA. It includes breaking changes and improvements over v2.

We’d love for you to try it out and share your feedback! Please open an issue if you encounter any problems or have suggestions.

📚 Migration Guide • 📦 v3 Changelog • 🤖 Auth0 Skill

Skill for Coding Agents: If you use coding agents such as Claude Code or Cursor, add the Auth0 skill to automate the upgrade:
npx skills add auth0/agent-skills --skill auth0

Documentation

Quickstart - shows how to integrate Auth0.swift into an iOS / macOS app from scratch.
Sample App - a complete, running iOS / macOS app you can try.
API Documentation - documentation auto-generated from the code comments that explains all the available features.
FAQ - answers some common questions about Auth0.swift.
Auth0 Documentation - explore our docs site and learn more about Auth0.

Getting Started

Requirements

iOS 15.0+ / macOS 12.0+ / tvOS 15.0+ / watchOS 8.0+ / visionOS 1.0+
Xcode 26.x
Swift 6.0+

[!IMPORTANT] Check the Support Policy to learn when dropping Xcode, Swift, and platform versions will not be considered a breaking change.

Installation

Using the Swift Package Manager

Open the following menu item in Xcode:

File > Add Package Dependencies…

In the Search or Enter Package URL search box enter this URL:

https://github.com/auth0/Auth0.swift

Then, select the dependency rule and press Add Package.

Using Cocoapods

Add the following line to your Podfile:

pod 'Auth0', '~> 3.0.0'

Then, run pod install.

Using Carthage

Add the following line to your Cartfile:

github "auth0/Auth0.swift" ~> 3.0.0

Then, run carthage bootstrap --use-xcframeworks.

Configure the SDK

Head to the Auth0 Dashboard and create a new Native application.

Auth0.swift needs the Client ID and Domain of the Auth0 application to communicate with Auth0. You can find these details in the settings page of your Auth0 application. If you have a custom domain, use your custom domain instead of the value from the settings page.

[!IMPORTANT] Make sure that the Auth0 application type is Native. Otherwise, you might run into errors due to the different configuration of other application types.

Configure the Client ID and Domain with a plist

Create a plist file named Auth0.plist in your app bundle with the following content:


    ClientId
    YOUR_AUTH0_CLIENT_ID
    Domain
    YOUR_AUTH0_DOMAIN

Configure the Client ID and Domain programmatically

Configure Web Auth (iOS / macOS)

Configure the callback and logout URLs

The callback and logout URLs are the URLs that Auth0 invokes to redirect back to your app. Auth0 invokes the callback URL after authenticating the user, and the logout URL after removing the session cookie.

Since callback and logout URLs can be manipulated, you will need to add your URLs to the Allowed Callback URLs and Allowed Logout URLs fields in the settings page of your Auth0 application. This will enable Auth0 to recognize these URLs as valid. If the callback and logout URLs are not set, users will be unable to log in and out of the app and will get an error.

Go to the settings page of your Auth0 application and add the corresponding URLs to Allowed Callback URLs and Allowed Logout URLs, according to the platform of your app. If you have a custom domain, replace YOUR_AUTH0_DOMAIN with your custom domain instead of the value from the settings page.

[!NOTE] On iOS 17.4+ and macOS 14.4+ it is possible to use Universal Links as callback and logout URLs. When enabled, Auth0.swift will fall back to using a custom URL scheme on older iOS / macOS versions.

Whenever possible, Auth0 recommends using Universal Links as a secure way to link directly to content within your app. Custom URL schemes can be subject to client impersonation attacks.

This feature requires Xcode 15.3+ and a paid Apple Developer account.

iOS

https://YOUR_AUTH0_DOMAIN/ios/YOUR_BUNDLE_IDENTIFIER/callback,
YOUR_BUNDLE_IDENTIFIER://YOUR_AUTH0_DOMAIN/ios/YOUR_BUNDLE_IDENTIFIER/callback

macOS

https://YOUR_AUTH0_DOMAIN/macos/YOUR_BUNDLE_IDENTIFIER/callback,
YOUR_BUNDLE_IDENTIFIER://YOUR_AUTH0_DOMAIN/macos/YOUR_BUNDLE_IDENTIFIER/callback

Configure an associated domain

[!IMPORTANT] This step requires a paid Apple Developer account. It is needed to use Universal Links as callback and logout URLs. Skip this step to use a custom URL scheme instead.

Configure the Team ID and bundle identifier

Scroll to the end of the settings page of your Auth0 application and open Advanced Settings > Device Settings. In the iOS section, set Team ID to your Apple Team ID, and App ID to your app’s bundle identifier.

This will add your app to your Auth0 tenant’s apple-app-site-association file.

Add the associated domain capability

In Xcode, go to the Signing and Capabilities tab of your app’s target settings, and press the + Capability button. Then select Associated Domains.

Next, add the following entry under Associated Domains:

webcredentials:YOUR_AUTH0_DOMAIN

If you have a custom domain, replace YOUR_AUTH0_DOMAIN with your custom domain.

[!NOTE] For the associated domain to work, your app must be signed with your team certificate even when building for the iOS simulator. Make sure you are using the Apple Team whose Team ID is configured in the settings page of your Auth0 application.

Import the Auth0 module in the file where you want to present the login page.

import Auth0

Then, present the Universal Login page in the action of your Login button.

Auth0
    .webAuth()
    .useHTTPS() // Use a Universal Link callback URL on iOS 17.4+ / macOS 14.4+
    .start { result in
        switch result {
        case .success(let credentials):
            print("Obtained credentials: \(credentials)")
        case .failure(let error):
            print("Failed with: \(error)")
        }
    }

[!NOTE] Completion callbacks are executed on the main thread, making it safe to update UI directly. If needed, explicitly dispatch to a background thread.

Web Auth logout (iOS / macOS)

Logging the user out involves clearing the Universal Login session cookie and then deleting the user’s credentials from your app.

Call the logout() method in the action of your Logout button. Once the session cookie has been cleared, delete the user’s credentials.

Auth0
    .webAuth()
    .useHTTPS() // Use a Universal Link logout URL on iOS 17.4+ / macOS 14.4+
    .logout { result in
        switch result {
        case .success:
            print("Session cookie cleared")
            // Delete credentials
        case .failure(let error):
            print("Failed with: \(error)")
        }
    }

SSO alert box (iOS / macOS)

Check the FAQ for more information about the alert box that pops up by default when using Web Auth.

[!NOTE] See also this blog post for a detailed overview of single sign-on (SSO) on iOS.

Examples

Explore common use cases and integration patterns for Auth0.swift.

[!NOTE] For comprehensive guides: See the Examples documentation for in-depth tutorials on biometric authentication, passkeys, passwordless login, DPoP, IPSIE session expiry, custom token exchange, and more. ✨

Store credentials

When your users log in, store their credentials securely in the Keychain.

let credentialsManager = CredentialsManager(authentication: Auth0.authentication())
do {
    try credentialsManager.store(credentials: credentials)
} catch {
    print("Failed to store credentials: \(error)")
}

Retrieve stored credentials

Retrieve the stored credentials from the Keychain. If the credentials have expired, they will be automatically renewed using the refresh token.

credentialsManager.credentials { result in 
    switch result {
    case .success(let credentials):
        print("Obtained credentials: \(credentials)")
    case .failure(let error):
        print("Failed with: \(error)") 
    }
}

IPSIE session expiry [EA]

[!NOTE] This feature is currently available in Early Access. It requires session-expiry enforcement enabled on your OIDC or Okta enterprise connection in the Auth0 Dashboard.

When an enterprise connection (OIDC / Okta) is configured with session-expiry enforcement enabled, Auth0 emits a session_expiry claim in the ID token. The CredentialsManager automatically enforces this upstream IdP session ceiling — credentials(), ssoCredentials(), and apiCredentials() clear the stored credentials and return CredentialsManagerError.sessionExpired once the ceiling is reached (with a 30-second clock-skew leeway), without attempting a token renewal. The ceiling is pinned at the initial login: the value from the first ID token is persisted to the Keychain and never updated by a refresh-token grant. clear() removes it on logout.

credentialsManager.credentials { result in
    switch result {
    case .success(let credentials):
        print("Obtained credentials: \(credentials)")
    case .failure(CredentialsManagerError.sessionExpired):
        // Upstream IdP session ended — prompt re-login
    case .failure(let error):
        print("Failed with: \(error)")
    }
}

For a full guide including configuration steps and reading the raw claim value, see the IPSIE session expiry section in EXAMPLES.md.

Clear stored credentials

The stored credentials can be removed from the Keychain by using the clear() method.

[!NOTE] It is recommended to call clear() when the user logs out of the application to remove their credentials from the Keychain.

let credentialsManager = CredentialsManager(authentication: Auth0.authentication())
do {
    try credentialsManager.clear()
} catch {
    print("Failed to clear credentials: \(error)")
}

Retrieve stored user profile

The stored user profile can be retrieved from the stored ID token synchronously without checking if credentials are expired:

do {
    let user = try credentialsManager.userProfile()
    print("User profile: \(user)")
} catch {
    print("Failed to retrieve user profile: \(error)")
}

Retrieve user information

Fetch the latest user information from the /userinfo endpoint.

Auth0
   .authentication()
   .userInfo(withAccessToken: credentials.accessToken)
   .start { result in
       switch result {
       case .success(let user):
           print("Obtained user: \(user)")
       case .failure(let error):
           print("Failed with: \(error)")
       }
   }

Multi-factor authentication

[!IMPORTANT] Multi Factor Authentication support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative.

Implement multi-factor authentication (MFA) flows using the MFA API. This includes enrolling MFA factors, challenging enrolled factors, and verifying MFA codes.

[!NOTE] For complete MFA implementation examples including SMS, email, OTP, and push notifications, see the MFA section in EXAMPLES.md.

Handle MFA required errors

When MFA is required during login, extract the MFA token and available factors from the error to proceed with the MFA flow.

Auth0
    .authentication()
    .login(usernameOrEmail: "[email protected]",
           password: "secret-password",
           realmOrConnection: "Username-Password-Authentication")
    .start { result in
        switch result {
        case .success(let credentials):
            print("Obtained credentials: \(credentials)")
        case .failure(let error) where error.isMultifactorRequired:
            if let mfaPayload = error.mfaRequiredErrorPayload {
                let mfaToken = mfaPayload.mfaToken
                print("MFA token: \(mfaToken)")

                // Check available factors for enrollment or challenge
                if let enrollTypes = mfaPayload.mfaRequirements.enroll {
                    print("Available for enrollment: \(enrollTypes.map { $0.type })")
                }
                if let challengeTypes = mfaPayload.mfaRequirements.challenge {
                    print("Available for challenge: \(challengeTypes.map { $0.type })")
                }
            }
        case .failure(let error):
            print("Failed with: \(error)")
        }
    }

Enroll an OTP authenticator

Enroll a time-based one-time password (TOTP) authenticator app like Google Authenticator or Authy.

Auth0
    .mfa()
    .enroll(mfaToken: mfaToken)
    .start { result in
        switch result {
        case .success(let challenge):
            // Display QR code to user
            if let barcodeUri = challenge.barcodeUri {
                print("QR Code URI: \(barcodeUri)")
            }
            if let secret = challenge.secret {
                print("Secret: \(secret)")
            }
        case .failure(let error):
            print("Failed with: \(error)")
        }
    }

Verify an OTP code

Complete the MFA authentication by verifying the OTP code from the user’s authenticator app.

Auth0
    .mfa()
    .verify(otp: "123456", mfaToken: mfaToken)
    .start { result in
        switch result {
        case .success(let credentials):
            print("Obtained credentials: \(credentials)")
        case .failure(let error):
            print("Failed with: \(error)")
        }
    }

Support Policy

This Policy defines the extent of the support for Xcode, Swift, and platform (iOS, macOS, tvOS, and watchOS) versions in Auth0.swift.

Xcode

The only supported versions of Xcode are those that can be currently used to submit apps to the App Store. Once a Xcode version becomes unsupported, dropping it from Auth0.swift will not be considered a breaking change, and will be done in a minor release.

Swift

The minimum supported Swift minor version is the one released with the oldest-supported Xcode version. Once a Swift minor becomes unsupported, dropping it from Auth0.swift will not be considered a breaking change, and will be done in a minor release.

Platforms

We support only the last four major versions of any platform, including the current major version.

Once a platform version becomes unsupported, dropping it from Auth0.swift will not be considered a breaking change, and will be done in a minor release. For example, a given major version of iOS will cease to be supported once the fourth subsequent major version is released, and Auth0.swift will be able to drop it in a minor release.

In the case of macOS, the yearly named releases are considered a major platform version for the purposes of this Policy, regardless of the actual version numbers.

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Auth0 is an easy-to-implement, adaptable authentication and authorization platform. To learn more check out Why Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.

View this README on GitHub

Recommended Tools

Try a different keyword or remove a filter.

Install

npx skillfish add auth0/auth0.swift