OidcDeviceClient

public class OidcDeviceClient : @unchecked Sendable

A client that implements the RFC 8628 Device Authorization Grant (requesting-device side).

Use OidcDeviceClient when the device cannot open a browser directly (e.g., a smart TV or CLI tool). Call deviceAuthorization() to start the flow and receive a stream of DeviceFlowStatus updates. The stream yields .started with the userCode and verificationUri to display, then .polling on each poll, and finally .success, .accessDenied, or .expired when the flow resolves.

Important

OidcClientConfig is marked @unchecked Sendable and contains mutable var fields. Do not mutate the config after passing it to this initializer — the polling loop captures the config and reads it from a background thread.

  • Initializes a new OidcDeviceClient.

    Declaration

    Swift

    public init(config: OidcClientConfig)

    Parameters

    config

    The OIDC client configuration to use.

  • Creates an OidcDeviceClient using the provided configuration block.

    Declaration

    Swift

    public static func createOidcDeviceClient(block: (OidcClientConfig) -> Void) -> OidcDeviceClient

    Parameters

    block

    A closure to configure the OidcClientConfig.

    Return Value

    A fully configured OidcDeviceClient.

  • Creates an OidcDeviceClient from a unified JSON configuration dictionary.

    Parses and validates the platform-neutral schema and delegates to createOidcDeviceClient(block:) with the extracted values. Unknown fields are silently ignored for forward compatibility.

    Endpoint overrides (e.g. deviceAuthorizationEndpoint) are expressed as an openId sub-object inside oidc and applied after OIDC discovery completes, mirroring the openIdOverride closure on OidcClientConfig.

    Declaration

    Swift

    public static func createOidcDeviceClient(json: [String : Any]) -> Result<OidcDeviceClient, Error>

    Parameters

    json

    A [String: Any] dictionary conforming to the unified SDK configuration schema.

    Return Value

    .success(OidcDeviceClient) on valid input, .failure(JsonConfigError) if a required field is absent or a field has the wrong type.

Device Authorization

  • deviceAuthorization() Asynchronous

    Starts the RFC 8628 device authorization flow.

    1. Calls config.oidcInitialize() to set up the HTTP client and discover endpoints.
    2. POSTs to the device_authorization_endpoint to obtain a DeviceAuthorizationResponse.

    Throws

    OidcError.unknown if the discovered configuration does not include a device authorization endpoint; OidcError.apiError if the initial POST fails.

    Declaration

    Swift

    public func deviceAuthorization() async throws -> AsyncThrowingStream<DeviceFlowStatus, Error>

    Return Value

    An AsyncThrowingStream<DeviceFlowStatus, Error>.

Browser Authorization

  • Opens the verificationUriComplete URL in an SFSafariViewController so the user can approve the device flow on this device. Suspends until the browser is dismissed (either via the redirect callback or because the user closed it); the polling loop in deviceAuthorization() continues independently while this method is awaiting.

    Throws

    OidcError.unknown if verificationUriComplete is not a valid URL or config.redirectUri has no scheme; BrowserError.externalUserAgentCancelled if the user closed the browser before completing the flow, or any other error surfaced by BrowserLauncher.

    Declaration

    Swift

    public func authorize(verificationUriComplete: String) async throws

    Parameters

    verificationUriComplete

    The verification URI (including user_code) returned in the DeviceAuthorizationResponse.

Revoke

  • revoke() Asynchronous

    Revokes the stored token by delegating to OidcClient.

    Declaration

    Swift

    public func revoke() async

User

  • user() Asynchronous

    Returns an OidcUser if a token exists in storage; otherwise returns nil.

    Declaration

    Swift

    public func user() async -> (any User)?