AuthenticationServices

Sign in with Apple, passkeys (WebAuthn/FIDO2), and web-based OAuth on Apple platforms. The deep API reference — setup, entitlements, the full Apple ID / passkey / OAuth flows, the AuthenticationManager and PasskeyManager implementations, server integration, and version compatibility — lives in references/guide.md. This file is the decision and discipline layer: read it first, open the guide for specifics.

Dials

Set these explicitly at the start; they change what "correct" means.

1. AUTH_METHOD — apple-id (Sign in with Apple, iOS 13+, the default for first-party accounts) · passkey (passwordless WebAuthn, iOS 16+, needs associated domains) · oauth (third-party IdP via ASWebAuthenticationSession) · combined (offer several requests in one ASAuthorizationController).
2. TOKEN_VERIFICATION — server (default; the identityToken JWT and authorizationCode are verified server-side against Apple's public keys — required for any real account system) · client-only (prototype/demo only; never grants real access).
3. BIOMETRIC_GATE — none (default) · local-auth (re-gate a returning session behind Face ID/Touch ID via the localauthentication skill — AuthenticationServices establishes identity, LocalAuthentication re-confirms the device owner).

When to use

Building or reviewing any sign-in, account-creation, passkey, or third-party OAuth flow that uses AuthenticationServices. Use this for establishing who the user is. For locking an already-signed-in session behind Face ID/Touch ID, that is a different concern — use localauthentication. If purchases/entitlements are involved, that is storekit / revenuecat, not this skill.

Core rules