peterfernandez_360

As an Architect, Consultant, and Engineer, I have more than 30 years of experience designing and developing secure and robust software solutions. When not helping teams deal with the complexities of Customer Identity, you can usually find me working behind the scenes, acting in or directing a show at my local theatre.

Principal Developer Advocate

Peter Fernandez

A step-by-step guide to leveraging OAuth 2.0 when accessing protected APIs via an iOS app built with Swift and integrated with Auth0.

Calling a Protected API from an iOS Swift App

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Learn how to add authentication (login and logout) to iOS apps built with SwiftUI with Auth0 and the Auth0.Swift package.

Get Started with iOS Authentication using SwiftUI, Part 1: Login and Logout

Add personalization to your iOS/SwiftUI app with user info from the ID token, a JWT (JSON Web Token) that you’ll read with the Swift JWTDecode library.

In Part 1 of this tutorial, you created a SwiftUI-based iOS app that uses Auth0 for basic login and logout functionality. In this part, you’ll enhance your app by giving it the ability to read the user’s profile to display their photo, name, and email address when they’re logged in.

<include 
    src="LinkCard" 
    title="Calling a Protected API from an iOS Swift App" 
    link="https://auth0.com/blog/calling-protected-apis-from-ios-swift/" 
    description="Looking for a step-by-step guide to leveraging OAuth 2.0 when accessing protected APIs via an iOS app built with Swift? If you're integrating with Auth0, then this is everything you need to know!"     img="https://images.ctfassets.net/23aumh6u8s0i/5PC3nu1F68m8S3BmJFv9SN/e83487c6d89d72fb6a49155722959b1d/ios_hero_2021_2.jpeg"
/>

Once again, you can follow the text in this article, or if you prefer learning by video, you can follow the steps in this article’s companion video:

<iframe width="600" height="338" src="https://www.youtube.com/embed/xOBoLegDmTw" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

> Look for the 🛠 emoji if you’d like to skim through the content while focusing on the build and execution steps.
> 
> The 📺 emoji highlights links to specific points in the video.


## Examine the ID Token

📺 [The _Examine the ID Token_ section of the video](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2008s)
 
If you look at the `.success` case of the `switch` statement in `ContentView`’s `login()` method, you’ll see these `print()` functions:

```swift
print("Credentials: \(credentials)")
print("ID token: \(credentials.idToken)")
```

These functions’ output will appear in Xcode’s Debug area:

![Xcode screenshot highlighting the Debug area.](https://images.ctfassets.net/23aumh6u8s0i/2Odv2P2CeeMGBoKSHNl3ly/2ba5ae37dbc5afafb94e82f95f41a722/debug_area.png)

> If the Debug area isn’t visible, open the _View_ menu and select _Debug Area_ → _Show Debug Area_ or use the keyboard shortcut _command-Shift-Y_.

You’ll see the contents of the `credentials` object and its `idToken` property, which should look similar to this:

```
Credentials: Credentials(accessToken: "<REDACTED>", tokenType: "Bearer", idToken: "<REDACTED>", refreshToken: nil, expiresIn: 2022-03-20 04:38:25 +0000, scope: Optional("openid profile email"), recoveryCode: nil)
ID token: eyJhbGciOiJSUzI1NiIsInR5cC...
```

The `credentials` object is a package of information that Auth0 sends to your app after authenticating a user. This information includes:

- **ID token:** Data that proves that the user has been authenticated.
- **Access token:** Data that gives a client application permission to access a specific resource to perform specific actions on the user’s behalf.
- **Refresh token:** Applications use this to get additional access tokens when the original access token expires without requiring the user to re-authenticate.
- **Scopes:** A set of [OpenID Connect (OIDC) scopes](https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes) — authorizations for access to details about the user — that Auth0 has granted to the app. Unless you specify otherwise, *Auth0.swift* defaults to requesting the following scopes when logging in a user:
	- `openid`: Authorization to use OIDC to verify the user's identity
	- `profile`: Authorization to access the user’s name information
	- `email`:  Authorization to access the user’s email address

> Want to know more about ID tokens and access tokens? We explain all in our article, [_ID Token and Access Token: What's the Difference?_](https://auth0.com/blog/id-token-access-token-what-is-the-difference/)
> 
> Want to know more about refresh tokens? See our article, [_What Are Refresh Tokens and How to Use Them Securely_](https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/).

The piece of information that we’re most interested in (for this exercise) is the ID token.

When the `print()` function is used to output the contents of `credentials`, the values of the `idToken` and `accessToken` properties are replaced with the string `<REDACTED>` as a security measure. Malicious parties can use tools to capture the output of `print()` functions from production apps; this is why `Credentials` instances redact the values of their `idToken` and `accessToken` properties when printed.

Note that when we use the `print()` function to output `credentials.idToken` — the ID token itself — the value is _not_ redacted. That’s because this value is useful for debugging, which we’ll do in the next step.

> It’s fine to print the value of the ID token to the debug console while you’re learning about the authentication process or building the app. Make sure you remove `print()` statements — especially those that print sensitive information, such as the ID token — before putting them into production!


### What’s in the ID token?

📺 [The _What’s in the ID token?_ section of the video](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2118s)

To see what’s in the ID token, copy its value from the Debug area, go to Auth0’s [JWT.io site](https://jwt.io/) and paste that value into the _Encoded_ text area on the left side of the page. JWT.io will decode the ID token from its JWT form and display its decoded contents in the _Decoded_ area on the page’s right side:

![JWT.io and the decoded ID token.](https://images.ctfassets.net/23aumh6u8s0i/4sg6VirydfCzVVenH6LWil/174552abed55b4fe3d8100493c1510db/jwt.io_screenshot.png)

In the _Decoded_ area’s _Payload_ section, you’ll see the decoded user information from the ID token, including the data that we want the app to display: the user’s name, email address, and picture.

In the next step, we’ll give the app the same ID token-decoding capability as JWT.io’s.

> Auth0 has plenty of information about JWTs. In addition to the main [JWT.io page](https://jwt.io/), you should visit JWT.io’s [_Introduction to JSON Web Tokens_](https://jwt.io/introduction) and download our [free JWT Handbook](https://auth0.com/resources/ebooks/jwt-handbook).


## Get the User’s Information

📺 [The _Get the User’s Information_ section of the video](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2223s)

The app only “knows” whether the user is logged in or logged out in its current state. It also has information about the user’s identity encoded in the ID token. Let’s extract this user information — the *user profile* — and use it to display the user’s name, email address, and picture when the user is logged in. 

🛠 In `Profile`, add the following `import` statement before the `struct Profile` line:

```Swift
// [ 📄 Profile.swift ]

import JWTDecode

// [ More code here ]
```

🛠 In the `Profile` extension, replace the `// TODO: Implement the 'from()' method.` comment with this `from()` method. It uses a couple of methods from the newly-imported `JWTDecode` library:

```swift
// [ 📄 Profile.swift ]

// [ More code here ]

  static func from(_ idToken: String) -> Self {
    guard
      let jwt = try? decode(jwt: idToken),
      let id = jwt.subject,
      let name = jwt.claim(name: "name").string,
      let email = jwt.claim(name: "email").string,
      let emailVerified = jwt.claim(name: "email_verified").boolean,
      let picture = jwt.claim(name: "picture").string,
      let updatedAt = jwt.claim(name: "updated_at").string
    else {
      return .empty
    }

    return Profile(
      id: id,
      name: name,
      email: email,
      emailVerified: String(describing: emailVerified),
      picture: picture,
      updatedAt: updatedAt
    )
  }
  
// [ More code here ]
```

Given an ID token string, the `from()` function creates a `Profile` instance. If `from()` can extract claims — values about the user’s identity, which include their name, email address, and the URL for their picture — from the ID token, it returns a `Profile` instance with that information in its properties. Otherwise, it returns a `Profile` instance with empty properties.


## Display the User’s Information

📺 [The _Display the User’s Information_ section of the video](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2424s)

Now that there’s a way to extract information from an ID token, let’s put it to use. 

Since `userProfile` is marked with the `@State` attribute, it defines the user interface’s state. Whenever `userProfile` or one of its properties changes, the app redraws the user interface to reflect the change.

We want to display the user’s information when they log in, so we’ll use `Profile`’s newly-created `from()` method in the `login()` method.

🛠 Open `ContentView` and update `login()` as shown below:

```swift
// [ 📄 ContentView.swift ]

// [ More code here ]

  func login() {
    Auth0 // 1
      .webAuth() // 2
      .start { result in // 3
        switch result {
          // 4
          case .failure(let error):
            print("Failed with: \(error)")
          // 5
          case .success(let credentials):
            self.isAuthenticated = true
            // 👇🏽👇🏽👇🏽 New line of code here!
            self.userProfile = Profile.from(credentials.idToken)
            // 👆🏽👆🏽👆🏽
            print("Credentials: \(credentials)")
            print("ID token: \(credentials.idToken)")
        }
      }
  }

// [ More code here ]
```

The newly-added line of code runs after the user logs in, and the app receives the ID token. It creates a new `Profile` instance from the data in the ID token and sets `ContentView`’s `userProfile` property to that instance.

When the user logs out, we should clean up the user profile just to be safe.

🛠 Update `logout()` as shown below:

```swift
// [ 📄 ContentView.swift ]

// [ More code here ]

  func logout() {
    Auth0
      .webAuth()
      .clearSession { result in
        switch result {
          case .success:
            self.isAuthenticated = false
            // 👇🏽👇🏽👇🏽 New line of code here!
            self.userProfile = Profile.empty
            // 👆🏽👆🏽👆🏽

          case .failure(let error):
            print("Failed with: \(error)")
        }
      }
  }

// [ More code here ]
```


## Run the App Again

📺 [The _Run the App Again_ section of the video](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2566s)

Run the app and confirm that the changes work. When you log in, you should see the user’s name, email address, and picture:

![The app’s “logged in” screen, featuring the text “Logged in” and displaying the user’s picture, name, and email address.](https://images.ctfassets.net/23aumh6u8s0i/1zYLUYAU3fdbLLde9PmhCN/90854331950e7557fbcc52db5bcb7379/logged_in_screen.png)

Congratulations, and high-fives and handshakes all around! You’ve taken a SwiftUI app and given it the ability to authenticate users with Auth0.


## Next Steps

SwiftUI is an expansive topic; we only scratched its surface in this tutorial. For your next steps in exploring it, you might want to look at these valuable resources:

- [SwiftUI by Example](https://www.hackingwithswift.com/quick-start/swiftui)
- [Your First SwiftUI App](https://www.youtube.com/watch?v=VlhcNR7Qrno)
- [Stanford University’s “Developing Applications for iOS” course for Spring 2021](https://www.youtube.com/playlist?list=PLpGHT1n4-mAsxuRxVPv7kj4-dQYoC3VVu)

📺 Last but not least, the video ends with [closing remarks and a quick accordion number](https://www.youtube.com/watch?v=xOBoLegDmTw&t=2645s)!

Get Started with iOS Authentication using SwiftUI, Part 2: User Info, ID Tokens, and JWTs

A step-by-step guide to leveraging OAuth 2.0 Refresh Tokens in an iOS app built with Swift and integrated with Auth0.

Using a Refresh Token in an iOS Swift App

poovamraj

I'm a senior software engineer at Auth0. From Rust to Kotlin, Java to JavaScript, I love exploring new languages, technologies, and frameworks. Away from the screen, you can find me in the Alps hiking.

Senior Software Engineer

Poovamraj Thanganadar Thiagarajan

We added support for hooks and rewrote it in TypeScript, made API improvements, improved Expo, Android, and iOS integration, and we think you’ll like it.

**We’re excited to announce the general availability of version 3.0 of our React Native SDK!** In this latest version, we’ve transformed our [`react-native-auth0` SDK](https://github.com/auth0/react-native-auth0) to work with two goals in mind:

* To work with the latest and greatest version of React Native, and 
* To create improvements to make your life as a developer easier. 

Read on to find out more about the new version of the SDK!


## What Changed?

We wanted to improve your developer experience and let you focus on what your applications do. We listened to your feedback, made changes to remove the obstacles that were getting in your way, and cut out the confusing parts that were slowing you down.

In this new version of the SDK, we made the following changes:

**100% support for hooks.** You’ve been asking for access to our authentication APIs (such as login via SMS, email, and so on) through hooks. That makes sense — after all, the general consensus is that React hooks generally make for more concise code that’s easier to read and maintain. So we went “all in”: our SDK now has 100% support through hooks! (And yes, you can still use it “the old way” too!)

**Improved `user` object and credentials.** The `User` object (available through our hooks API) isn’t static anymore and doesn’t just capture a snapshot of the user’s information at the moment of login. Instead, it dynamically updates to reflect changes to the user in real time. You can now force-refresh the user credentials, check their validity, and you can do so using either hooks or classes.

**Expo improvements.** The SDK now seamlessly integrates into any Expo project with a single line of configuration. You just specify the domain, and the SDK automatically generates the other configuration lines. We’ve also raised the minimum supported version of Expo to a more stable version (currently v48).

**Completely rewritten in TypeScript.** This allows us to take advantage of TypeScript’s type safety and removes any confusion about what data you provide to and receive from the SDK’s methods. (It also has the side benefit of making the SDK easier to maintain and update, which we believe will provide future benefits for you.)

**Improved Android/iOS interoperability.** We switched from React Native’s Android and iOS SDKs for web authentication to our own SDKs, which we use in the `Auth0.Android` and `Auth0.Swift` packages. Ours are battle-tested, more reliable, and less buggy, which provides your users with a better login/logout experience.


## Requirements

Naturally, you’ll need an Auth0 account to use the SDK. <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">You can sign up for a free account here;</a> the free version supports unlimited login/logout for up to 7,000 users and ten applications.

### Which versions of React Native are supported?

Version 3 of our React Native SDK targets apps using React Native version `0.60.5` and up.

### Is Expo supported?

This SDK _is_ compatible with Expo [custom development client](https://blog.expo.dev/introducing-custom-development-clients-5a2c79a9ddf8) and [EAS (Expo Application Services)](https://expo.dev/eas) builds. 

⚠️ Please note that the SDK is _not_ compatible with the [Expo Go](https://expo.dev/client) app because of the SDK’s use of custom native code.

### Which versions of Android and iOS are supported?

Version 3 of our React Native SDK supports the following mobile platform versions:

* **Android SDK 28, also known as “Android 9” or “Pie” (or later).** Android 9 was released in August 2018. 84% of devices active in the Play Store at the time of writing (August 2023) will run applications targeting this Android version. The oldest phones that support this version of Android date back to late 2017.
* **iOS 13 (or later).** iOS 13 was released in September 2020. As of the end of February 2023, almost 88% of iOS users were running iOS 16, with nearly 12% running iOS 15. iOS 14 users accounted for about 0.2% of users, while users of iOS 13 and earlier comprised the remaining 0.3%. The oldest iPhones that will run iOS 13 are the 6S and 6s Plus, which date back to 2015. Simply put, you’re not really leaving anyone behind by setting iOS 13 as the oldest supported version.


## How to Find Out More

* [**The `react-native-auth0` GitHub repository.**](https://github.com/auth0/react-native-auth0/) You can find the code here, as well as more than enough documentation to get started using the SDK — it’s all in the README file.
* [**The migration guide.**](https://github.com/auth0/react-native-auth0/blob/master/MIGRATION_GUIDE.md) This document covers the improvements that we made going from version 2 to version 3, changes that might break your current implementations, and changes to the format for callback URLs. If you’re working with projects based on the v2 SDK, make sure you read this.
* **Quickstarts.** The fastest way to create a new project that uses the Auth0 React Native SDK is to use a quickstart. We have a [**React Native quickstart**](https://auth0.com/docs/quickstart/native/react-native/interactive) and an [**Expo quickstart**](https://auth0.com/docs/quickstart/native/react-native-expo/interactive).
* **Sample projects.** These sample projects will help you get acquainted with the Auth0 React Native SDK in general and version 3 in particular:
	* [Login/logout app using React components](https://github.com/auth0-samples/auth0-react-native-sample/tree/master/00-Login)
	* [Login/logout app using React hooks](https://github.com/auth0-samples/auth0-react-native-sample/tree/master/00-Login-Hooks)
	* [Login/logout app using Expo](https://github.com/auth0-samples/auth0-react-native-sample/tree/master/00-Login-Expo)
* [**Code examples.**](https://github.com/auth0/react-native-auth0/blob/master/EXAMPLES.md) This is a collection of code snippets that shows you how to perform specific tasks using the SDK.


## Summary

We made version 3 of the React Native for Auth0 SDK based on your feedback to improve the developer and user experiences. With support for hooks, better integration with both Android and iOS, strong typing support, and fewer bugs, we’re sure you’ll enjoy working with this version!

Introducing Auth0 React Native SDK 3.0!

We asked ChatGPT to write code to integrate Auth0 into an iOS app after its initial release. The code didn’t work then. Will it work this time?

## What Happened in Round One

Barely two weeks after the initial release of ChatGPT, I tidied up my home office/studio, put on my newest Aloha shirt, and started asking the newly-released AI some questions about OAuth and Auth0. The result was the video below, which you’ll find on the OktaDev YouTube channel: _Chatting with ChatGPT About Auth0:_

<iframe width="600" height="338" src="https://www.youtube.com/embed/rfkgdorO-8Y" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>

ChatGPT gave correct answers to these questions:

- “What is OAuth?” and a follow-up question where I asked it for a more layperson-friendly version of its initial answer.
- “What is OIDC?” and the same follow-up question as my previous one.
- What is an ID token?
- What is an access token?
- What is a refresh token?
- Are there security downsides to using refresh tokens with indefinite lifespans?

ChatGPT didn’t do as well when I asked it, “How do I write an iOS app that uses Auth0 for login?” The set of steps it suggested was correct, but it said that I should use the  `Auth0.authentication()` method to make the Universal Login screen appear. **No such method exists**.


## And Now, Round Two! 

Half a year has passed since I asked ChatGPT about adding Auth0 authentication to an iOS app. Over that period, OpenAI’s developers added a newer model, GPT 4.0, which you can access only if you have a paid account. They also made adjustments and improvements to the original GPT 3.5 model, which powers the free version of ChatGPT.

I decided to see if the free version of ChatGPT could give me a working iOS authentication code this time. I asked it **“How do I write an iOS app that uses Auth0 for login and logout?”**

Here’s ChatGPT’s response, which I’ve condensed slightly for brevity:

1. Set up an Auth0 account.
2. Create an iOS project. Set it up with the desired UI and navigation flow for the login and logout functionality.
3. Install the Auth0 SDK. You can use CocoaPods or Swift Package Manager to install the SDK dependencies.
4. Configure your Auth0 application by providing the necessary settings, such as allowed callback URLs and logout URLs.
5. Implement login functionality: Create a login view controller or integrate the login functionality into an existing view controller. Use the Auth0 SDK to initiate the login process by presenting the Auth0 login screen. The user will be able to enter their credentials or choose a social login option.
6. Handle login callback: Once the user successfully logs in, Auth0 will redirect them back to your app. You need to implement the callback handling in your app to receive the authentication result. This typically involves handling a URL scheme or Universal Link that Auth0 uses to redirect back to your app.
7. Store and manage tokens: When the login is successful, Auth0 provides an access token and, optionally, a refresh token. You'll need to store these tokens securely, such as using the iOS Keychain, and handle token refreshing when necessary.
8. Implement logout functionality: Create a logout function that clears the stored tokens and logs out the user. You can use the Auth0 SDK to perform the logout operation.
9. Secure API requests: To secure your app's API requests, include the access token in the authorization header when making requests to your backend services. Ensure that your backend verifies the authenticity of the token with Auth0.
10. Test and refine: Thoroughly test your app's login and logout functionality to ensure it works as expected. Make any necessary refinements or enhancements based on user experience and feedback.

I then asked **“Could you show me some Swift code that uses Auth0 for login and logout?”**

Its response: “Certainly! Here's an example of Swift code that demonstrates how to use Auth0 for login and logout in an iOS app,” followed by this code:

```swift
import Auth0

class Auth0Manager {
    let auth0 = Auth0.webAuth(clientId: "YOUR_CLIENT_ID", domain: "YOUR_DOMAIN")

    func login(completion: @escaping (Error?) -> Void) {
        auth0
            .scope("openid profile")
            .audience("https://YOUR_API_IDENTIFIER")
            .start { result in
                switch result {
                case .success(let credentials):
                    // Successful login
                    let accessToken = credentials.accessToken
                    let idToken = credentials.idToken
                    // Store the tokens securely

                    completion(nil)

                case .failure(let error):
                    // Handle error
                    completion(error)
                }
            }
    }

    func logout() {
        auth0.clearSession(federated: true) { result in
            switch result {
            case .success:
                // Successful logout
                // Clear stored tokens and any other user data

            case .failure(let error):
                // Handle error
                print("Logout error: \(error)")
            }
        }
    }
}
```

My thought was probably what you’re thinking right now: _Does this code work?_

I opened a copy of the iOS project I use for demonstrating Auth0 authentication, which is based on the Auth0 iOS Quickstart app (you can [download a version configured with your Auth0 tenant settings](https://auth0.com/docs/quickstart/native/ios-swift/01-login) or [get it from this Github repository](https://github.com/auth0-samples/auth0-ios-swift-sample/tree/master/Sample-01)). I added a new file to the project, `Auth0Manager.swift`, and pasted the class that ChatGPT generated there. I replaced these placeholder values...

- `YOUR_CLIENT_ID` with my app’s client ID
- `YOUR_DOMAIN`with my tenant’s domain
- `YOUR_API_IDENTIFIER` with `https://YOUR_DOMAIN/api/v2/`, replacing `YOUR_DOMAIN` with my tenant’s domain

…and replaced my demo app’s calls to its original `login()` and `logout()` methods with calls to the versions that ChatGPT provided.

I ran the app...

...and it worked! It appears that this time, ChatGPT — and the _free_ version at that — got it right.


## A Closer Look At ChatGPT’s Code

Now that it’s clear that ChatGPT now knows how to write code to integrate Auth0 into an iOS app let’s take a look at the way it did this.

<img src="https://images.ctfassets.net/23aumh6u8s0i/2g2IgpFO8E6hNzFAwaDfdc/e2042210acd1c1b96f3c4629001a5d39/gavel.png" align="left" style="padding: 20px;" alt="Judge’s gavel resting on a hardcover book." />To make this exercise a little more fun, I’ll keep a running score where I’ll award points for what I thought were good things that ChatGPT did and deduct points for things that I thought were bad ones. Watch for the picture of the gavel for these scores.


### The Auth0Manager class

This is different from a lot of [tutorial code](https://auth0.com/blog/get-started-ios-authentication-swift-uikit/), which puts the Auth0 logic and data — the`login()` and `logout()` methods as well as the variables to hold the tokens that Auth0 returns —  inside the view object that makes the call to display the Universal Login screen or log the user out. Many tutorials take this approach because it shows all the code in a single file, which is useful when you’re trying to explain something new to the reader.

In a _real_ iOS app (as opposed to a tutorial app), you’d probably take the same approach as ChatGPT’s and put the authentication and authorization code in its own class. In fact, [that’s what we do in tutorials showing how to integrate Auth0 into Android apps](https://auth0.com/blog/add-progressive-profiling-auth0-authentication-android-apps-jetpack-compose/) since they rely heavily on ViewModels that inherit from Android’s built-in `ViewModel` class.

<img src="https://images.ctfassets.net/23aumh6u8s0i/2g2IgpFO8E6hNzFAwaDfdc/e2042210acd1c1b96f3c4629001a5d39/gavel.png" align="left" style="padding: 20px;" alt="Judge’s gavel resting on a hardcover book." />I’ve decided to follow ChatGPT’s example and put Auth0 code in its own class in my tutorials from now on to make my tutorial code a little closer to real-world code. For this idea, I’ll award ChatGPT 1 point.


### The WebAuth instance

ChatGPT’s `Auth0Manager` class has a single property, `auth0`, a `WebAuth` instance whose definition is as follows:

```swift
let auth0 = Auth0.webAuth(clientId: "YOUR_CLIENT_ID", domain: "YOUR_DOMAIN")
```

`Auth0.webAuth()` is a function in the _Auth0.Swift_ library that creates an instance of the `WebAuth` class, which provides the necessary methods for logging a user in and out. Both the `login()` and `logout()` methods use this instance.

ChatGPT’s solution uses the version of `Auth0.webAuth()` that takes two arguments: the client ID and the domain. It’s the most straightforward way to show how you can use Auth0 to implement login and logout in an app, but you probably wouldn’t do this in a production application since you’d be hard-coding server credentials.

Fortunately, there’s another form of `Auth0.webAuth()` that _doesn’t_ take arguments for the client ID and domain. In fact, it doesn’t take _any_ arguments, and you’d use it like this:

```swift
let auth0 = Auth0.webAuth()
```

Instead of relying on arguments that you pass to it, this form of `Auth0.webAuth()` looks through the app’s property lists (a.k.a. _plists_) for values corresponding to the following keys:

- `ClientId` for the client ID
- `Domain` for the tenant domain

You would typically create a new property list — usually named `Auth0.xml` — and store the `ClientID` and `Domain` values there. Here’s what it would look like in an Xcode project if you prefer editing property lists visually...

![auth0_plist](https://images.ctfassets.net/23aumh6u8s0i/6LexUyPkhqCzEvMCASpR37/246ed1182fd7d410cebaca9c4a6d01b0/auth0_plist.png)

...and here’s how it would look if you prefer editing property lists as source code:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Domain</key>
    <string>** Put your tenant’s domain here ***</string>
    <key>ClientId</key>
    <string>** Put your app’s client ID here ***</string>
</dict>
</plist>
```

Putting the client ID and domain values in their own file makes it easy to exclude them from version control, which makes it less likely that you’ll unintentionally share these values with people outside your organization.

<img src="https://images.ctfassets.net/23aumh6u8s0i/2g2IgpFO8E6hNzFAwaDfdc/e2042210acd1c1b96f3c4629001a5d39/gavel.png" align="left" style="padding: 20px;" alt="Judge’s gavel resting on a hardcover book." />ChatGPT’s implementation works when trying to explain how to implement something, which earns it 1 point. However, its implementation isn’t one that you should use in a production application, and it should have explained this fact, so I’m deducting the point I just gave it. ChatGPT’s current score is holding at 1 point.


### The login() method

Let’s take a look at ChatGPT’s `login()` method:

```swift
func login(completion: @escaping (Error?) -> Void) {
    auth0
        .scope("openid profile")
        .audience("https://YOUR_API_IDENTIFIER")
        .start { result in
            switch result {
            case .success(let credentials):
                // Successful login
                let accessToken = credentials.accessToken
                let idToken = credentials.idToken
                // Store the tokens securely

                completion(nil)

            case .failure(let error):
                // Handle error
                completion(error)
            }
        }
}
```

Its `login()` implementation is mostly the same as the `login()` methods in our tutorials or our iOS Quickstart app. There’s the usual method chaining from the `webAuth` instance, where the methods are called in this order:

- `scope()` to request the minimum amount of scopes necessary to authenticate a user:
    -   `openid` to indicate that we want to use OpenID Connect (OIDC) to verify the user’s identity. Since Auth0 authentication is OIDC-based, Any application using Auth0 must request this scope.
    -  `profile` to retrieve the user’s name.
    -  The ChatGPT code doesn’t include a request for the `email` scope, which I would recommend, simply for access to the user’s email address, which is typically how an app would send out-of-band communications to the user.
-  `audience()` to specify one or more APIs that the access token that Auth0 returns should grant access to. In the rare case that you’re using Auth0 for authentication only, you can skip this method call. In my case, I passed it the string `https://MY_DOMAIN/api/v2/`, replacing `MY_DOMAIN` with my tenant’s domain. This is the URL for the Auth0 user management API, which is useful for accessing the user’s app and user metadata.
- `start()` to indicate what the app should do in the cases where the user was able to log in and where they weren’t.

The big difference between ChatGPT’s implementation of `login()` and the ones we’ve been using here on the Auth0 blog and in our Quickstarts can be seen in the `login()` method’s signature:

```swift
func login(completion: @escaping (Error?) -> Void)
```

ChatGPT’s version of `login()` has a parameter, `completion`, that takes an argument of type `(Error?) -> Void`. This argument is a closure that takes an argument of type `Error?` (a value whose type is `Error`, a subclass of `Error`, or `nil`) and does not return a value. The `@escaping` annotation informs Swift that the closure provided to `login()` might [outlive or go beyond `login()`’s scope](https://www.donnywals.com/what-is-escaping-in-swift/).

The `completion` parameter allows the code that calls `login()` to perform additional actions upon successful login and also in case login fails:

- If the user logged in successfully, `login()` calls `completion(nil)`.
- If the user’s attempt to log in failed, `login()` calls `completion(error)`, where `error` is the `Error` instance returned by `start()` method of the `WebAuth` instance contained in the `auth0` property.

The code calling `login()` must provide a closure argument that specifies what extra actions should happen whether the login succeeds or fails. For example, here’s the code in my demo app that calls `Auth0NManager`’s `login()` method:

```swift
auth0Manager.login() { error in
    if let error = error {
        print("Login error!")
        isAuthenticated = false
    } else {
        print("Login successful!")
        isAuthenticated = true
    }
}
```

<img src="https://images.ctfassets.net/23aumh6u8s0i/2g2IgpFO8E6hNzFAwaDfdc/e2042210acd1c1b96f3c4629001a5d39/gavel.png" align="left" style="padding: 20px;" alt="Judge’s gavel resting on a hardcover book." />I like ChatGPT’s addition of the <code>completion</code> parameter and feel no shame in stealing this idea (is it even possible to steal from an AI?). I’m granting ChatGPT 1 point, resulting in a total of 2 points so far.


### The logout() method

Here’s ChatGPT’s `logout()` method:

```swift
func logout() {
    auth0.clearSession(federated: true) { result in
        switch result {
        case .success:
            // Successful logout
            // Clear stored tokens and any other user data
            print("Logged out!")
            
        case .failure(let error):
            // Handle error
            print("Logout error: \(error)")
        }
    }
}
```

ChatGPT’s implementation of the `logout()` method is pretty much the same as the `logout()` methods in our tutorials or our iOS Quickstart app.

I would steal ChatGPT’s trick from its `login()` method and add a `completion` parameter that takes a closure that performs additional actions for both successful and unsuccessful logouts. My implementation would look something like this:

```swift
func logout(completion: @escaping (Error?) -> Void) {
    auth0.clearSession(federated: true) { result in
        switch result {
        case .success:
            // Successful logout
            // Clear stored tokens and any other user data
            completion(nil)
            
        case .failure(let error):
            // Handle error
            completion(error)
        }
    }
}
```

And here’s how I’d call the `logout()` method:

```swift
auth0Manager.logout() { error in
    if let error = error {
        print("Logout error!")
    } else {
        print("OK")
        isAuthenticated = false
    }
}
```

<img src="https://images.ctfassets.net/23aumh6u8s0i/2g2IgpFO8E6hNzFAwaDfdc/e2042210acd1c1b96f3c4629001a5d39/gavel.png" align="left" style="padding: 20px;" alt="Judge’s gavel resting on a hardcover book." />ChatGPT didn’t provide a <code>completion</code> parameter for the <code>logout()</code> method as it did for the <code>login()</code> method. I won’t award it a point, but I won’t take one away, either. At the end of this exercise, ChatGPT has 2 points. Not bad!


## Is Your Developer Job Safe?

Considering that it’s been only half a year since we last tested ChatGPT’s ability to write code that integrates Auth0 into iOS apps, this is an impressive improvement. You might be wondering what kinds of leaps it might make over the next couple of years if AIs keep advancing at the same pace, and more importantly, what this means for your career as a developer.

I don’t think of AIs like ChatGPT as a threat. Instead, I think of them as part of a long series of cognitive aids that include  [tally sticks](https://en.wikipedia.org/wiki/Tally_stick), [the abacus](https://www.ecb.torontomu.ca/~elf/abacus/intro.html), writing, [logarithmic tables](https://www.cuemath.com/algebra/log-table/), and [slide rules](https://sliderulemuseum.com/SR_Course.htm), as well as their more modern counterparts such as the combination of search engines and Stack Overflow, [code completion](https://en.wikipedia.org/wiki/Intelligent_code_completion), and [GitHub Copilot](https://github.com/features/copilot). I think that AIs can enhance what a human programmer can do and even provide ideas and inspiration that they might not think of. After all, ChatGPT’s answer provided me with a couple of ideas that I’m going to use in future code.

You might find it helpful to read this IEEE Spectrum article, [_How Coders Can Survive—and Thrive—in a ChatGPT World_](https://spectrum.ieee.org/ai-programming), which lists four ways in which developers can stay ahead of generative AIs. It captures my thinking about AI and programming in its final paragraph:

<blockquote>For programmers to survive in a generative AI world, they’ll need to embrace AI as a tool and incorporate AI into their workflow while recognizing the opportunities and limitations of these tools—and still relying on their human coding capabilities to thrive.</blockquote>

ChatGPT Tries to Add Auth0 Authentication to an iOS App, Round Two!

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

amin-abbaspour

G'day. I look after Professional Services in APAC. I'm passionate about helping customers build and secure their applications and get the best value out of their investment with Auth0. Besides work, I love spending time with my kids, Ryan and Adeline, as well as reading, weightlifting and watching NRL (National Rugby League).

Lead Solutions Architect

Amin Abbaspour

Learn how to add user authentication to Flutter apps using OAuth 2.0 and OpenID Connect.

Get Started with Flutter Authentication

Learn about the essential features of the Auth0 Flutter SDK and how it helps developers build and secure Flutter iOS and Android applications.

Today we are announcing the release of the [Auth0 Flutter SDK](https://pub.dev/packages/auth0_flutter), a new SDK that makes it easy to secure Flutter applications with Auth0. Whether you need to secure access to an iOS or Android application, the Auth0 Flutter SDK got you covered!

The new Flutter SDK builds on a strong foundation by wrapping our existing and robust [Auth0.Android](https://github.com/auth0/Auth0.Android) and [Auth0.swift](https://github.com/auth0/Auth0.swift) libraries while focusing on the developer experience first.

Our SDK team optimized the Auth0 Flutter SDK for quick integration into your applications and for flexibility to accommodate simple and advanced use cases.

Since the introduction of [Flutter 3](https://medium.com/flutter/introducing-flutter-3-5eb69151622f), the framework allows for building cross-platform applications, extending from mobile applications to desktop applications and platforms. Our SDK allows for extension in such platforms by leveraging federated plugins, which means you can easily add support for other platforms without forking the SDK.

## Auth0 Flutter SDK Features

The new SDK offers features for multiple use-cases and complexity, going from magically getting the job done to providing a rich set of APIs enabling you to build your authentication flow per your specific requirements.

Let's explore the essential features of the Auth0 Flutter SDK that enable developers to do more:

- ⚡️ Quick implementation of login, logout, and automatic storage and renewal of tokens functionality into Flutter apps using WebAuth and the [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) page.
- ⚙️ For more advanced use-cases, developers have access to the [Authentication API](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/AuthenticationApi-class.html), which at the time of release supports:
	- Logging in with a username or email and password
	- Signing up new users
	- Getting user information from `/userinfo`
	- Renew tokens
	- Reset passwords
- 🔐 Auth0 provides a default instance of [Credentials Manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/DefaultCredentialsManager-class.html) that automatically stores the user's credentials. If you need your own solution for handling credentials, you can create your own [custom credentials manager](https://pub.dev/documentation/auth0_flutter/latest/auth0_flutter/CredentialsManager-class.html).
- ➕ And more [advanced features](https://pub.dev/packages/auth0_flutter#advanced-features) like accepting user invites, login into organizations, and bot detection.

## Requirements

The Auth0 Flutter SDK doesn't require any other library to work. However, there are SDK version and platform requirements for your project:

<table style="width:100%" cellspacing="2" cellpadding="5">
    <thead>
        <tr style="border-bottom: solid 1px">
            <td>**Flutter**</td>
            <td>**Android**</td>
            <td>**iOS**</td>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>SDK 3.0+</td>
            <td>Android API 21+</td>
            <td>iOS 12+</td>
        </tr>
        <tr>
            <td>Dart 2.17+</td>
            <td>Java 8+</td>
            <td>Swift 5.3+</td>
        </tr>
        <tr>
            <td></td>
            <td></td>
            <td>Xcode 13.x / 14.x</td>
        </tr>
    </tbody>
</table>

Check the [project on GitHub](https://github.com/auth0/auth0-flutter/tree/main/auth0_flutter#requirements) to for the most up-to-date set of requirements.

## Installing the SDK

The Auth0 Flutter SDK is distributed via [pub.dev](https://pub.dev/packages/auth0_flutter).

To add the SDK, run the following command from the root directory of your project:

```bash
flutter pub get auth0_flutter
```

## Adding Universal Login to Your Flutter Application

Adding the full-featured [Auth0 Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login) authentication page to your application is easy with the SDK.

Please explore the [Flutter Quickstart guide](https://auth0.com/docs/quickstart/native/flutter/interactive) to see in detail how to set up your Flutter application to use the Auth0 SDK. For now, let's take a quick peak at how the Flutter SDK integration goes!

### Add login to your app

Integrate Auth0 Universal Login in your Flutter app by using the Auth0 class. Redirect your users to the Auth0 Universal Login page using `webAuthentication().login()`. This is a `Future` and must be awaited for you to retrieve the user's tokens.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').login();
```

### Add logout to your app

Logging out users is as easy as calling the Auth0 Flutter SDK `webAuthentication().logout()` function. The `logout()` function is responsible for calling the `logout` endpoint to clear their login session and to clear the user login state from the device session.

```dart
await auth0.webAuthentication(scheme: 'YOUR CUSTOM SCHEME').logout();
```

## Next Steps

There are a lot of options to work with with the SDK, and in this post, we only barely scratch the surface of it. If you want to learn more about the SDK, please check out the [quick start guide](https://auth0.com/docs/quickstart/native/flutter/interactive) and the [SDK documentation](https://pub.dev/packages/auth0_flutter).

Thanks for reading!

Introducing the Auth0 Flutter SDK

Learn how to use user and app metadata in Auth0 user profiles to store additional information about your users.

Working with Auth0 User and App Metadata in iOS Apps

A step-by-step tutorial on using Auth0 and Swift to implement login/logout and use user metadata in iOS apps.

Get Started with iOS Authentication using Swift and UIKit

wern ancheta

Hi! I’m Wern Ancheta. I’m a Web Developer from San Fernando City, La Union, Philippines. I love building things for the web and sharing the things I’ve learned through writing. When I’m not coding or learning something new, I enjoy watching anime and playing video games.

Guest Author

Wern Ancheta

Learn how to add authentication to React Native iOS apps with Auth0.

Get Started with Auth0 Authentication in React Native iOS Apps

bruno-lorenzo

I'm a software engineer with more than seven years of working experience. I worked for four years in a consultant company designing and implementing scalable and flexible systems. <br>

In 2018 I decided to move on into the iOS world. Currently, I'm working as iOS Tech. Lead at Houlak. I have been involved in several projects of different sizes which gives me the possibility to explore the latest technologies related to the iOS ecosystem.

Software Engineer

Bruno Lorenzo

Take a look at techniques that you can use right now to make your iOS apps more secure.

Security Best Practices in iOS

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Supporting Sign in with Apple on iOS and web apps can be an easy task if you use the right tools.

How to Implement Sign in with Apple Easily on iOS Apps

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Following Apple’s release of Sign in with Apple and iOS13, Auth0 support coming next week



Using third-party or social login services such as Facebook or Google for app login? Apple’s new App Store Developer Guidelines require that if your app exclusively uses a third-party or social login service to setup or authenticate the user’s primary account, the app [must](https://developer.apple.com/news/?id=06032019j) provide Sign in With Apple for your end-users (existing apps and app updates have until April 2020 to be compliant.)

![Sign In with Apple feature landing page mockup screenshot](https://images.ctfassets.net/23aumh6u8s0i/7mvfWW2HPoJ1fAZzJ5wKNc/6d6b119e6ba2723024e5e2875297d56d/hero)

## Smooth Adoption Expected

Once iOS users complete their initial sign-in, they’ll be able to subsequently sign in using the native bio verification mechanisms built into iOS devices like thumbprints and Face ID. When users can do this instead of having to enter a password, we expect this will quickly become the login path of choice.

## Privacy Play

GDPR sparked a [global shift in data privacy](https://auth0.com/explore/data-privacy/). While organizations are thinking harder about the data they store and where it flows, Apple has realized the need to support end-user choices — which is why SIgn In With Apple allows users to obfuscate their real identity from third-parties including app developers.

So if I use Sign in with Apple, and select “Hide my Email”, application developers will not have any personally identifiable information from my login. The application will only recognize me based on a randomly generated email address from Apple that is uniquely identifiable so that Apple can maintain the correct association. 

This causes a slight problem for application developers who rely on email addresses to associate accounts to actual people. Apple has taken a hard stance on this but it is also evolving its identity practices at a rapid pace. Auth0 has kept up with these recent changes and will be releasing a solution that has been beta-tested with actual customers and end-users next week.

If you need Sign In With Apple to do business and you’re doing it yourself, you’re about to touch code — and then every time Apple makes a change, you’ll need to touch it again to ensure that code is keeping pace. The advantage of Auth0 is that we shield you from every change from Apple or other identity providers. Even adding features like multi-factor authentication can easily be switched on with a toggle.

## What’s Coming Next Week

![Sign-in with Apple Flows](https://images.ctfassets.net/23aumh6u8s0i/4Ir5yzLS6BxzCoIXjg8U1a/95e05a6faf160e091ee3a4afc2981c76/siwa-flows)

The General Availability (GA) of our Sign In With Apple integration will include Native flows and Web flows. Web flows have been in [public beta since June](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/), enabling customers who want to use Sign In with Apple in web applications to try it out. At Auth0, Sign In With Apple will be an out-of-the-box feature — a simple toggle + minimal code.

![Sign In With Apple Has Been In Public Beta Since June](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

Offloading authentication to Auth0 means touching code when YOU want to make a change, not when your identity provider tells you to. And it means you can quickly comply with Apple’s mandate while leveraging the benefits of Face or Touch ID and eliminate the need for usernames/passwords.

With 1.4 billion iOS devices already in the market and nearly two million apps competing for iOS users’ attention this change could be a big deal — if Auth0 didn’t already have you covered.


Ready for 1.4 Billion iOS Devices?

michael-bui

I'm a software developer with a background in consulting and experience in technical leadership roles. The majority of my career has been with using .NET to build applications across the full-stack and for mobile, desktop, and web. My main area of interest is in agile software development and building cross-platform applications using technologies like Flutter and Xamarin.Forms.

These days I do more work using Flutter. Besides using it professionally to build applications, I've done a talk at a meetup, maintain a blog where I post about Flutter in <a href="https://dexterx.dev">DexterX</a> and contribute to and maintain various open-source projects.

Sofware Developer

Michael Bui

Learn the basics of the Flutter development kit and the Dart programming language and build an app to manage your shopping wishlist.

Build a Flutter Wishlist App, Part 1: Introducing Flutter and Building a Basic Wishlist App

daniel-krzyczkowski-2020

Software Engineer passionate about Microsoft technologies. Awarded with Microsoft Most Valuable Professional title. The main part of his activities is to share knowledge and passion about Microsoft Azure, IoT, Universal Windows Platform and DevSecOps.


Daniel Krzyczkowski

Learn how to add authentication to iOS and Android apps with Xamarin and Auth0.

Easy Authentication in Xamarin Apps with Auth0

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Popular third-wave coffee brand makes app experience seamless for devotees



**BELLEVUE, Wash. -- August 7, 2018 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that its Universal Identity Platform is being used to authenticate users for [Philz Coffee](https://www.philzcoffee.com/)’s new mobile app. The highly-publicized app has been getting attention for its unique user experience, and serves as an easy way for Philz Coffee loyalists to easily place a custom order from their phones. 

Philz, a national coffee company with more than 40 locations in California and Washington DC, is expanding rapidly and wanted to cater to coffee drinkers devoted to its highly personalized "One Cup at a Time" approach. As an extension of its dedication to customers, the Philz mobile app provides a simple and quick way for people to order online, preview the full menu of drink offerings, and view additional locations. 

Philz is using Auth0 to provide authentication to its mobile app for both iOS and Android. They implemented Auth0 for the release of the new app, and since its launch, there has been a dramatic increase in downloads and it is now being used by more than 50,000 customers. App adoption is expected to continue growing as more store locations are added.

"Our mission at Philz is to better people's days through warmth and connection, ‘One Cup at a Time'," said Francisca Hawkins, VP of Digital at Philz Coffee. "When we set out to make our app, we wanted it to reflect the care we take with each customer interaction, and Auth0 provided the best authentication platform to support our app goals." 

"Anyone who knows Philz Coffee knows that it’s a brand dedicated to a highly-personalized experience," said Eugenio Pace, CEO and Co-founder of Auth0. "The app is part of the holistic Philz Coffee experience and we are happy to provide our technology to the brand and its very loyal following."

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Philz Coffee Authenticates Mobile App Users with Auth0

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

In this tutorial we implement centralized logins for iOS both manually and using the Auth0 SDK.

Add Authentication To Your iOS Apps with Centralized Login

b7e1e53144c06ecfdef91f0e4229a08a

Rafael Sacchi

How MVVM and VIPER can be good alternatives to the traditional MVC in iOS projects

Comparing MVVM and Viper architectures: When to use one or the other

TL;DR: You can get a working sample that uses Auth0, Cognito, and iOS in this Github repository   We’ve come to an era where a critical component of a

> TL;DR: You can get a working sample that uses Auth0, Cognito, and iOS in [this Github repository](https://github.com/auth0/Lock.iOS-OSX/tree/master/Examples/Cognito.Swift)

---
We’ve come to an era where a critical component of a solution is providing a fantastic experience for the user. The focus is now on the client: web or native. But all powerful apps need a backend, which usually mean servers you run that expose an API.  However, it is now possible to securely interact with services like Amazon Cognito, Firebase, and others directly from the client code, with no server of your own.

<include src="TweetQuote" quoteText="It is now possible to securely interact with services like Amazon Cognito from the client code"/>

In this post, I’ll explain how you can integrate your mobile app with two solutions: Auth0 to get authentication with either [Social Providers](https://auth0.com/docs/identityproviders#2) (Facebook, Twitter, etc.), [Enterprise providers](https://auth0.com/docs/identityproviders#1) or regular Username and Password, and [Amazon Cognito](http://aws.amazon.com/cognito/), to get a backend for your app without writing a line of code



## Configuring Amazon Web Services
### Create a new OpenID Connect Provider
The first step is to create an OpenID Connect Provider pointing to your Auth0 account. Please take a note of your auth0 domain (_accountName_.auth0.com) and your _clientId_ and use them to create the Identity Pool in the [IAM Console](https://console.aws.amazon.com/iam/home)

![IDP Creation](https://images.ctfassets.net/23aumh6u8s0i/6Y63AJyHviXQjZVm68iHxO/4ec239cdeea2efdc33a15fa56b11b3e4/IDPCreation)


### Create a Cognito Identity Pool
Now, you need to create an Identity Pool in [Cognito Console](https://console.aws.amazon.com/cognito/home). This will be used to login to Amazon Cognito using the Auth0’s Identity Provider that you created in the previous step.

![Cognito Pool Creation](https://images.ctfassets.net/23aumh6u8s0i/5EUrvgOb5vvaIgJDwvjoIr/e4a43260968a0437e651c3f6ff4890cb/IDPCognito)

> Please take a note of the ARN selected in the end of the gif. We’ll use it later on!

### Grab the Role ARN
Finally, grab the ARN of the role that was automatically created in the previous step from the [IAM console](https://console.aws.amazon.com/iam/home).

![Grab Role ARN](https://images.ctfassets.net/23aumh6u8s0i/5UQmUHK37LNYjwyoJRIcLU/d29382c6bc6b2c49e2721026388a115c/Roles)

## Code time!
Now it’s time to start coding our app. In this case, we’ll be using Swift, but the same sample applies to Objective C as well.

### Adding the Needed Dependencies

Add the following dependencies to your `Podfile`

````ruby
pod "Lock", "~> 1.7", :inhibit_warnings => true
pod "JWTDecode", "~> 0.2"
pod "SimpleKeychain", "~> 0.2"
pod 'AWSCognitoSync', "~> 1.0"
````
### Logging the User In
We’ll use [Auth0 Lock for iOS](https://github.com/auth0/lock) to log the user in. You can read detailed instructions on how to implement it in [this documentation page](https://auth0.com/docs/native-platforms/ios-swift).
Once the user is successfully logged in with Auth0, we’ll send his or her credentials to Amazon Cognito:

````swift
let authController = A0LockViewController()
authController.onAuthenticationBlock = {(profile:A0UserProfile!, token:A0Token!) -> () in
  // Save Tokens and Credentials into the keychain as you'd regularly do
  // ...

  let provider = AWSCognitoCredentialsProvider.credentialsWithRegionType(
    AWSRegionType.USEast1,
    // Your AWS Account ID
    accountId: Constants.AWSAccountID.value,
    // This is the ARN from Cognito Identity Pool
    identityPoolId: Constants.CognitoPoolID.value,
    unauthRoleArn: '',
    // This is the ARN from the Role
    authRoleArn: Constants.CognitoRoleAuth.value);


  let configuration = AWSServiceConfiguration(region: AWSRegionType.USEast1, credentialsProvider: self.provider);
  AWSServiceManager.defaultServiceManager().setDefaultServiceConfiguration(configuration)

  // Set here the Auth0 URL you've set when creating the OpenID Connect Provider
  provider.logins = ['samples.auth0.com': token.idToken]
  self.provider.getIdentityId().continueWithBlock { (task: BFTask!) -> AnyObject! in
      self.provider.refresh()
      if (task.error != nil) {
          // Fail
      } else {
          // Logged in with Cognito successfully
      }
      return nil
  }
}
````

### Using Cognito

Now, the user is logged in to Cognito through Auth0. You can now store information in Cognito that only this user will be able to use.

````swift
let cognitoSync = AWSCognito.defaultCognito()
let dataset = cognitoSync.openOrCreateDataset("MainDataset")
// Get an existing value
dataset.synchronize().continueWithBlock { (task) -> AnyObject! in
    dispatch_async(dispatch_get_main_queue(), { () -> Void in
        self.textValue.text = dataset.stringForKey("value")
    })
    return nil
}

// Set a new value
dataset.setString(self.textValue.text, forKey: "value")
dataset.synchronize()
````
## Let’s see how it works!

![Cognito working](https://images.ctfassets.net/23aumh6u8s0i/ZUyl8icWNGrXoT1NXVhZ8/fddada9455721f6a127d13193ee7e1ef/CognitoSample)

## Final Thoughts

That’s it! Now, your users can login with Github or any other identity provider using a native UI and save their information with Cognito easily.

Happy coding :).

Integrating Auth0 with Amazon Cognito in iOS

b93af62499ed0f76f280acb37913f15d

Hernan Zalazar

A few weeks back we released the first version of our native iOS SDK to help you add authentication to your app. We needed a Keychain library that supported

A few weeks back we released **the first version of our native [iOS SDK](https://github.com/auth0/auth0.ios)** to help you add authentication to your app.

We needed a **Keychain library** that supported the following features:

* **TouchID Support**: An option to make a private keychain value only available if the user entered his fingerprint
* **Accessibility options**: An option to state wether the keychain value could be got if the iPhone is Locked, Unlocked or in which state
* **Shared Group**: We needed Shared Group support so that 2 different apps could share keychain values

As there was no library that fulfilled our needs, **we decided to build [SimpleKeychain](https://github.com/auth0/SimpleKeychain)**.

Let’s see some of the different use cases that we’ve created and used.



## How do I store a value (e.g. JWT Token) in the Keychain?

```objc
NSString *jwt = //user's JWT token obtained after login
[[A0SimpleKeychain keychain] setString:jwt forKey:@"auth0-user-jwt"];
```

```swift
let jwt = //user's JWT token obtained after login
A0SimpleKeychain.keychain().setString(jwt, forKey:"auth0-user-jwt")
```

## How do I share a value (e.g. JWT token) between different apps?

When you have a family of apps that need to share the same user session, you can use iOS Keychain Sharing to store the token. That token must be stored under the same Access Group.

First in one of your apps save the JWT token:

```swift
let keychain = A0SimpleKeychain.keychainWithService("Auth0", accessGroup: "ABCDEFG.com.mydomain.mysharegroup")
let jwt = //user's JWT token obtained after login
keychain.setString(jwt, forKey:"auth0-user-jwt")
```

Then, you obtain the token in the other app:

```swift
let keychain = A0SimpleKeychain.keychainWithService("Auth0", accessGroup: "ABCDEFG.com.mydomain.mysharegroup")
let jwt = keychain.stringForKey("auth0-user-jwt")
```

## How I can handle the accessibility of the items saved in the keychain?

If you want to restrict when the item can be retrieved (For example only when the iPhone is unlocked, or if you want the entry to be included in any backup) you need to specify the item accessibility before saving:

```objc
A0SimpleKeychain *keychain = [A0SimpleKeychain  keychain];
keychain.defaultAccessibility = A0SimpleKeychainItemAccessibleWhenUnlockedThisDeviceOnly;
NSString *jwt = //user's JWT token obtained after login
[keychain setString:jwt forKey:@"auth0-user-jwt"];
```

## How can I trigger TouchID prompt before accessing the Keychain?

With the release of iOS 8, a new feature was added in order to tie a Keychain item to the user's passcode or their fingerprints .In order to use this feature, you need to store the value with accesibility `A0SimpleKeychainItemAccessibleWhenPasscodeSetThisDeviceOnly` and using iOS 8 Keychain Access Control:

```swift
let keychain = A0SimpleKeychain.keychain()
keychain.defaultAccesiblity = .WhenPasscodeSetThisDeviceOnly
keychain.useAccessControl = true
let jwt = //user's JWT token obtained after login
keychain.setString(jwt, forKey:"auth0-user-jwt")
```

Then whenever you query for that item a prompt will appear and the user will have to enter their fingerprint or passcode:

```swift
let message = NSLocalizedString("Please enter your passcode/fingerprint to login with awesome App!.", comment: "Prompt TouchID message")
let keychain = A0SimpleKeychain.keychain()
let jwt = keychain.stringForKey("auth0-user-jwt", promptMessage:message)
```

This is just a glimpse of all that you can accomplish with [SimpleKeychain](https://github.com/auth0/SimpleKeychain).

Add it to your **Swift or Objective C** project now with CocoaPods and start using it!:


```ruby
pod 'SimpleKeychain', '~> 0.1'
```

SimpleKeychain: A keychain library with iOS 8 &amp; TouchID support

csgyy2LVyeE+

Dmitry Zaytsev

This is a guest post by Dmitry Zaytsev. He is the Developer Evangelist at Appery.io Building mobile apps with identity management wasn't simple, until

_This is a guest post by Dmitry Zaytsev. He is the Developer Evangelist at [Appery.io](http://appery.io)_


Building mobile apps with identity management wasn't simple, until now. [Auth0](http://auth0.com/), a cloud service that eliminates the friction of identity for your app, and [Appery.io](http://appery.io/), the only cloud platform with visual development tools and integrated backend services are collaborating to make this happen.  With the jointly created Appery.io Auth0 plugin, you can simplify identity management integration for your app and this post will show you how.

Register for the Auth0 and Appery.io joint webinar on August 6, 2014 at 11:00 AM PT

**_Building Secure Mobile Apps in the Cloud with Appery.io and Auth0 Identity Management_**

[Register now](http://www.exadel.com/08062014Webinar)



## Appery.io Platform

[Appery.io](http://appery.io/) is the only cloud-based platform with visual development tools and integrated backend services. Appery.io provides a powerful visual environment to build HTML5 and hybrid mobile apps connected to any APIs.

The Appery.io platform provides the following core features:

* Build HTML5 mobile apps and hybrid apps for iOS, Android, and Windows Phone

* Drag and drop visual app builder for quickly building the app UI, with Source view for customizing the UI with any code

* Connect to any cloud API service, and bind the service to the page via a visual binding editor

* Integrated backend services that include: cloud database, push notifications, and server code

* HTML5 app hosting

* Fast testing in browser, and on device via Appery.io Mobile Tester app

* Collection of plugins that provide fast integration with popular API providers

## Visual App Builder

Building app UI in Appery.io is very fast using the advanced visual builder. The mobile UI components are on the left-hand side. To build the UI, you simply drag and drop the components into the device. Every UI component has properties which can be set via the Properties panel (on the right):

![Visual App Builder](https://images.ctfassets.net/23aumh6u8s0i/3clJBWZGm4tCySUAjL8BfK/6f7011c3d9cd98867ecbfecc2e607f3e/B2DAF0cEAbgb3FsiqaInSdZ8RkkHLExj5-9izi1aR2mnTxQliOZkF3ZMUJ6IP4RhqVq5hWiFkVULkd3iy99u8sidtNSISkwnWacj_JSkkbBKLbVDQFuPOrGAwq3waXLn)

Adding actions to a button click is quickly done via the Events tab. For instance, you can write any JavaScript to be invoked on a button click (or other event):

![Visual App Builder 2](https://images.ctfassets.net/23aumh6u8s0i/6P5Df0huaJkUqZwbPUiTEf/f48a714c20ec54d249677274a5b87e17/7GyJZC8SXIFWrwOiyWBTgEMfv081O7ieCVrQowtQWDXyDV12f49KNkdzw7oCbRgV67SnMw0PuRnnATbWN0U_c4fkCPZTJajT2OC_o-Ks6aCSG9-6bAEvGIvtdPOVU_Qv)

## REST API Services

Building app UI is important but also is connecting with any 3rd party APIs such as Salesforce, Facebook, SendGrid, and Auth0. Appery.io solves this problem by making it very fast and easy to add any API to the app, and the bind it to the page using visual data binding. This is an example defining a service that returns Auth0 token information:

![Rest Api Services](https://images.ctfassets.net/23aumh6u8s0i/5BoFW2PoLhvdLPBYzFnJBo/adf84e76882a77f39183d4cc36178b27/38L2zBGsejbOwDDDVGiTlsSsYepC8XLAQiDzR_fNpz1i02hmbA9BVE4dyM1r7APEZogKuxb2tWMH7mDzc0WymXh-FLM_Oym8rYuQI7oAZkDNXwUnXK7PzvWEJ1qS6OD2)

Mapping the data returned from Auth0 service to a page:

![Rest Api services 2](https://images.ctfassets.net/23aumh6u8s0i/7e1Qk9C1RHGyHQT5hdX87E/2f890da69f32f11d8b092dd1b1fa4c31/f0v1GEYi6GUCP1Z064X4Fr47F-vbzARBElLwEF5bwDvh7a7OAGoQV1agDDozkV6IxGdYRVlRo90sJqnboq5nFJA9yjQnW2tCRhik2JvvIELZn-gtZu-ANgQU0MPCwt5T)

## Integrated Backend Services

The Appery.io Backend Services includes three main features:

1. Cloud database for quickly storing any app data

![Integrated backend services](https://images.ctfassets.net/23aumh6u8s0i/5P98RTXGlAvYvZflmWN6gP/766ebb3b7b525e522a576f7047cd9826/J6hLmFvRmo_1AeIDfcfRt_xTRlp98RrP8Z3UOjFsRojVBMtZvyFH8kUV2K8lKYblaGVLFUYqOT5Sa_qEnt1DTUyV6JSD3ZlKjt-XV7xj6W_t6CYyhbZIFJTJm6BP6H55)

2. Push notifications for sending messages to users who installed the app:

![Rest Api services 2](https://images.ctfassets.net/23aumh6u8s0i/31rPCcCc4KuhmR7G02t0LP/4b622734479c8e4a75677c197e03bc25/I_BtkIOTQYzvaUJ1zQYVdXpg__MpJDy2VXbsCXXmnLfmw0X5WrHsFckKIZ2E9br6Vk6AwpZv2TZ0t9AOOQu7tSsGw1ArySLTpYZg4dcER3ojZB9vmsKQy1uf980NqBue)

3. Server Code enables writing custom and scalable business logic using JavaScript in the Appery.io cloud without the need to build and maintain server infrastructure:

## Auth0 Plugin

Appery.io provides a collection of ready-to-use plugins for various API providers. We are happy to announce the new Auth0 Identity Management plugin. The Auth0 plugin now makes it even faster to build apps with Auth0 zero-friction identity management solution.

![Auth0 Plugin for Appery](https://images.ctfassets.net/23aumh6u8s0i/4CyDbCmO1Hcu595jRrTEFf/c97b408ea1a35aa8b69112c3ed3cfd7c/ppOeUfH8YjtxPFsNAUql8TftkmrTnBzHpbsXnScEE3JYmnrdnH3FUnC2bX-fTGvgQo3_4395uKX398DmQbOfFRg_hJTpPOSs_Fulh4dUk1lF09HiNdzOdex_XER4pDXC)

Steps to add Auth0 plugin to Appery.io app:

1. Create an Appery.io app.

2. Import the Auth0 plug-in (use search to find it).

3. Opent the *Auth0_Setting* and fill it with Auth0 app data. There are three parameters, two of them (**Domain** and **Client Id)** you can simply copy from the Auth0 website:

4. ![Auth0 App Settings](https://images.ctfassets.net/23aumh6u8s0i/3127RYIYf2qKUMrUBwbhkG/9af604f0c6c24462cc91b8d667b69bad/kILU4jMp7WNqyUDzgwrB-FA-3TAJ-Sp32p8ITryDkPYVYCn8_a8GVwwmAweF-OtAQvsFt0iDe6UcCiUjeD8s9ZTeCPI4g64odHhDicvmCob5eHMw0IJhap3MSDkJEOhF)

5. The third parameter is the **redirect_uri**. The same value of this parameter should be entered in **App Callbacks URLs** in **Auth0 app settings**. Here is how it should look:

6. http://appery.io/app/view/APPERY-IO-APP-ID/Auth0_User.html

Generally, that's all you need to configure. With the Auth0 plugin imported, you can add new login option to your app via Auth0 services. Your app can now easily support login with any of the large number of Auth0 social and enterprise login providers.

![Auth0 Widget](https://images.ctfassets.net/23aumh6u8s0i/2n7orLKrZ59zlBKb5QmvkM/20a14092ad0dd144bb0f18a8d0585f83/cI2LilQrCOd_)

Easy, isn't it? Now your Appery.io app can use all features of Auth0 services. We created  a step-by-step [tutorial](http://devcenter.appery.io/documentation/plugins/using-the-auth0-plug-in-for-simple-identity-managment/) on how to add and use the Auth0 plugin in your app.

To learn more about building mobile apps in Appery.io with Auth0 services, please attend our joint webinar:

Register for Appery.io and Auth0 joint webinar on August 6, 2014 at 11:00 AM PT

**_Building Secure Mobile Apps in the Cloud with Appery.io and Auth0 Identity Management_**

[Register now](http://www.exadel.com/08062014Webinar)

"ios"