openid / AppAuth-iOS

AppAuth for iOS and macOS, and tvOS is a client SDK for communicating with 
OAuth 2.0 and 
OpenID Connect providers. 
It strives to
directly map the requests and responses of those specifications, while following
the idiomatic style of the implementation language. In addition to mapping the
raw protocol flows, convenience methods are available to assist with common
tasks like performing an action with fresh tokens.
It follows the best practices set out in 
RFC 8252 - OAuth 2.0 for Native Apps
including using `SFAuthenticationSession` and `SFSafariViewController` on iOS
for the auth request. `UIWebView` and `WKWebView` are explicitly *not*
supported due to the security and usability reasons explained in
Section 8.12 of RFC 8252.
It also supports the PKCE extension to
OAuth, which was created to secure authorization codes in public clients when
custom URI scheme redirects are used. The library is friendly to other
extensions (standard or otherwise), with the ability to handle additional params
in all protocol requests and responses.
For tvOS, AppAuth implements OAuth 2.0 Device Authorization Grant
 to allow for tvOS sign-ins through a secondary device.
## Specification
### iOS
#### Supported Versions
AppAuth supports iOS 15 and above.
Authentication is performed using `ASWebAuthenticationSession`.
#### Authorization Server Requirements
Both custom URI scheme redirects and HTTPS redirects (RFC 8252 "claimed https" redirect URIs) can
be used with the library. HTTPS redirects require iOS 17.4+, an Associated Domains entitlement
for the redirect host using the `webcredentials` service, and an AASA file on that host listing
the app under `webcredentials`. An `applinks` (Universal Links) association alone is not enough.
In general, AppAuth can work with any authorization server that supports
native apps, as documented in RFC 8252,
either through custom URI scheme redirects, or HTTPS redirects.
Authorization servers that assume all clients are web-based, or require clients to maintain
confidentiality of the client secrets may not work well.
### macOS
#### Supported Versions
AppAuth supports macOS 12 and above.
#### Authorization Server Requirements
AppAuth for macOS supports both custom schemes; a loopback HTTP redirects
via a small embedded server.
In general, AppAuth can work with any authorization server that supports
native apps, as documented in RFC 8252;
either through custom URI schemes, or loopback HTTP redirects.
Authorization servers that assume all clients are web-based, or require clients to maintain
confidentiality of the client secrets may not work well.
### tvOS
#### Supported Versions
AppAuth supports tvOS 15.0 and above. Please note that while it is possible to run the standard AppAuth library on tvOS, the documentation below describes implementing OAuth 2.0 Device Authorization Grant (AppAuthTV).
#### Authorization Server Requirements
AppAuthTV is designed for servers that support the device authorization flow as documented in RFC 8628.