Classes

An authenticator that uses an application PIN for user verification. This class provides an implementation for generating PIN-protected keys and authenticating the user by prompting for the PIN.

See more

public class AppPinAuthenticator : DefaultDeviceAuthenticator

An authenticator that uses biometrics (Face ID or Touch ID) with a fallback to device credentials (passcode/PIN).

This authenticator supports the BIOMETRIC_ALLOW_FALLBACK policy, allowing authentication via either biometrics (Face ID / Touch ID) or device passcode.

Security Model

Unlike BiometricOnlyAuthenticator which uses .biometryCurrentSet to have the Secure Enclave hardware-invalidate keys when biometric enrollment changes, this class uses a dynamic access control policy:

• Biometrics enrolled: .biometryAny OR .devicePasscode — allows both authentication methods.
• No biometrics enrolled: .devicePasscode only — avoids Secure Enclave key creation failure on devices that have a passcode set but no Face ID / Touch ID registered.

Because .biometryAny does not invalidate keys on biometric enrollment changes at the hardware level, this class compensates with a software-level check using LAContext.evaluatedPolicyDomainState. The biometric domain state is captured at bind time and stored in the UserKey. During signing, the stored state is compared against the current state — if they differ (e.g., a fingerprint was added or removed), the keys are deleted and re-binding is required by throwing .deviceNotRegistered.

Backward Compatibility

For UserKey instances created before this change (i.e., without a stored biometricDomainState), the enrollment check is skipped and signing proceeds normally. This ensures existing bindings are not broken on SDK update. Only keys created after the update will enforce the biometric domain state check.

See more

public class BiometricDeviceCredentialAuthenticator : DefaultDeviceAuthenticator

An authenticator that uses biometrics (Face ID or Touch ID) for user authentication. This class extends DefaultDeviceAuthenticator and provides specific implementations for biometric-only key generation, authentication, and support checks.

See more

public class BiometricOnlyAuthenticator : DefaultDeviceAuthenticator

A base class for device authenticators, providing default implementations for the DeviceAuthenticator protocol. Subclasses should override methods to provide specific authentication logic.

See more

open class DefaultDeviceAuthenticator : DeviceAuthenticator

An authenticator that does not require any user interaction. This authenticator is used when the authentication type is none.

See more

public class NoneAuthenticator : DefaultDeviceAuthenticator

A default implementation of PinCollector that uses a UIAlertController to prompt the user for their PIN.

See more

public class DefaultPinCollector : NSObject, PinCollector, @unchecked Sendable

A Journey callback for handling device binding. This callback is received from the AIC authentication flow when a device needs to be bound to a user account.

See more

public class DeviceBindingCallback : AbstractCallback, @unchecked Sendable, JourneyAware, ContinueNodeAware

A Journey callback for handling device signing verification. This callback is received from the AIC authentication flow when a challenge needs to be signed by a bound device.

See more

public class DeviceSigningVerifierCallback : AbstractCallback, @unchecked Sendable, JourneyAware, ContinueNodeAware

Configuration class for AppPinAuthenticator that defines PIN collection, storage, and security settings.

See more

public class AppPinConfig : AuthenticatorConfig

Configuration class for biometric authenticators.

See more

public class BiometricAuthenticatorConfig : AuthenticatorConfig

Configuration for device binding. This class allows you to customize the behavior of the device binding and signing process.

See more

public class DeviceBindingConfig

A class for managing cryptographic keys in the Keychain. This class provides methods for generating, retrieving, and deleting key pairs.

See more

public class CryptoKey

Manages the migration of device binding data from the legacy SDK to the new SDK format.

This class orchestrates a multi-step migration process that transfers user key metadata from the legacy keychain location to the new storage format.

Migration Steps

The migration executes three sequential steps:

1. Check for Legacy Data: Verifies if legacy keychain data exists and needs migration
2. Migrate User Keys: Transfers user key metadata from legacy keychain to new storage
3. Cleanup: Removes legacy keychain data after successful migration

Usage

Automatic migration (recommended):

// Migration starts automatically when BindingModule is first used
// or can be triggered explicitly
Task {
    try await BindingMigration.migrate()
}

Manual migration with custom configuration:

Task {
    try await BindingMigration.migrate(
        accessGroup: "com.myapp.keychain",
        logger: myLogger,
        cleanupLegacyData: true
    )
}

Progress Monitoring

The migration logs progress updates that can be observed through the provided logger:

• Migration started
• Legacy data check results
• Number of keys migrated
• Cleanup status
• Completion or error details

See more

public class BindingMigration

A module for handling device binding and signing callbacks. The callbacks are automatically registered when Journey.createJourney() is called. Manual registration using BindingModule.register() is optional and only needed if you’re not using the Journey framework.

See more

public class BindingModule : NSObject

Configuration for UserKeysStorage.

See more

public class UserKeyStorageConfig

The default implementation of UserKeySelector that uses a system alert to prompt the user.

See more

public class DefaultUserKeySelector : UserKeySelector, @unchecked Sendable