OathCredential

public struct OathCredential : Codable, Identifiable, Sendable, CustomStringConvertible, CustomReflectable

Represents an OATH (TOTP/HOTP) credential. This model holds all necessary information to generate OTP codes and identify the credential.

Note

The secret key is stored securely and not exposed in the public API.

id
Unique identifier for the credential (local ID).
Declaration
Swift

public let id: String
userId
User identifier on the server.
Declaration
Swift

public let userId: String?
resourceId
Server-side device identifier.
Declaration
Swift

public let resourceId: String?
issuer
The name of the issuer for this credential.
Declaration
Swift

public let issuer: String
displayIssuer
The name of the issuer for this credential, editable by the user.
Declaration
Swift

public var displayIssuer: String
accountName
The account name (username) associated with this credential.
Declaration
Swift

public let accountName: String
displayAccountName
The account name (username) associated with this credential, editable by the user.
Declaration
Swift

public var displayAccountName: String
oathType
The type of credential (TOTP or HOTP).
Declaration
Swift

public let oathType: OathType
oathAlgorithm
The HMAC algorithm used (SHA1, SHA256, SHA512).
Declaration
Swift

public let oathAlgorithm: OathAlgorithm
digits
The number of digits in the generated codes.
Declaration
Swift

public let digits: Int
period
For TOTP, the time period in seconds for which a code is valid.
Declaration
Swift

public let period: Int
counter
For HOTP, the counter value used to generate the next code.
Declaration
Swift

public var counter: Int
createdAt
The timestamp when this credential was created.
Declaration
Swift

public let createdAt: Date
imageURL
Optional URL for the issuer’s logo or image.
Declaration
Swift

public let imageURL: String?
backgroundColor
Optional background color for the credential.
Declaration
Swift

public let backgroundColor: String?
policies
Optional Authenticator Policies in a JSON String format for the credential.
Declaration
Swift

public let policies: String?
lockingPolicy
Optional name of the Policy locking the credential.
Declaration
Swift

public var lockingPolicy: String?
isLocked
Indicates whether the credential is locked.
Declaration
Swift

public var isLocked: Bool

Computed Properties

type
String representation of the OATH type.
Declaration
Swift

public var type: String { get }
algorithm
String representation of the OATH algorithm.
Declaration
Swift

public var algorithm: String { get }

Initializers


                    
                    
                    init(id:userId:resourceId:issuer:displayIssuer:accountName:displayAccountName:oathType:oathAlgorithm:digits:period:counter:createdAt:imageURL:backgroundColor:policies:lockingPolicy:isLocked:secretKey:)

Creates a new OATH credential.

Declaration

Swift

public init(
    id: String = UUID().uuidString,
    userId: String? = nil,
    resourceId: String? = nil,
    issuer: String,
    displayIssuer: String? = nil,
    accountName: String,
    displayAccountName: String? = nil,
    oathType: OathType,
    oathAlgorithm: OathAlgorithm = .sha1,
    digits: Int = 6,
    period: Int = 30,
    counter: Int = 0,
    createdAt: Date = Date(),
    imageURL: String? = nil,
    backgroundColor: String? = nil,
    policies: String? = nil,
    lockingPolicy: String? = nil,
    isLocked: Bool = false,
    secretKey: String
)

Parameters

`id`	Unique identifier for the credential. Defaults to a new UUID.
`userId`	User identifier on the server.
`resourceId`	Server-side device identifier.
`issuer`	The name of the issuer for this credential.
`displayIssuer`	The display name of the issuer, editable by the user.
`accountName`	The account name associated with this credential.
`displayAccountName`	The display account name, editable by the user.
`oathType`	The type of credential (TOTP or HOTP).
`oathAlgorithm`	The HMAC algorithm used.
`digits`	The number of digits in generated codes. Defaults to 6.
`period`	For TOTP, the time period in seconds. Defaults to 30.
`counter`	For HOTP, the counter value. Defaults to 0.
`createdAt`	The creation timestamp. Defaults to current date.
`imageURL`	Optional URL for the issuer’s image.
`backgroundColor`	Optional background color.
`policies`	Optional policies in JSON format.
`lockingPolicy`	Optional locking policy name.
`isLocked`	Whether the credential is locked. Defaults to false.
`secretKey`	The secret key for OTP generation.

Factory Methods


                    
                    
                    fromUri(_:)

Asynchronous

Creates an OATH credential from a URI string.

Throws

OathError.invalidUri if the URI is malformed.

Declaration

Swift

public static func fromUri(_ uri: String) async throws -> OathCredential

Parameters

uri

The URI string to parse.

Return Value

A new OathCredential instance.

toUri() Asynchronous
Converts this credential to a URI string.

Throws
OathError.uriFormatting if formatting fails.
Declaration
Swift

public func toUri() async throws -> String
Return Value

A URI string representation of this credential.

Policy Methods


                    
                    
                    lockCredential(policyName:)

Lock this credential due to policy violations.

Locked credentials cannot be used for code generation until they are unlocked. This is typically enforced by policy evaluators checking for jailbreak, device compromise, or other security violations.

Declaration

Swift

public mutating func lockCredential(policyName: String)

Parameters


                                policyName

The name of the policy that caused the lock.

unlockCredential()
Unlock this credential.

This removes any locking policy information and allows the credential to be used for code generation again.
Declaration
Swift

public mutating func unlockCredential()

Codable Implementation


                    
                    
                    init(from:)

Custom initializer for decoding. The secret key must be provided separately.

Throws

DecodingError if decoding fails.

Declaration

Swift

public init(from decoder: Decoder) throws

Parameters


                                decoder

The decoder to read data from.


                    
                    
                    encode(to:)

Custom encoder implementation that excludes the secret key.

Throws

EncodingError if encoding fails.

Declaration

Swift

public func encode(to encoder: Encoder) throws

Parameters


                                encoder

The encoder to write data to.

description
A textual description of the credential, excluding the secret key.
Declaration
Swift

public var description: String { get }

CustomStringConvertible & CustomReflectable

customMirror
Custom reflection for the credential, excluding the secret key.
Declaration
Swift

public var customMirror: Mirror { get }