Authentication (iOS)

User-facing sign-in for a fintech iOS app, built on Apple's AuthenticationServices (ASAuthorization*, ASWebAuthenticationSession) and LocalAuthentication (LAContext). Targets the iOS 26 era. This skill covers how the user proves identity; storing the resulting tokens/keys is a separate concern.

• Token & key storage / crypto / biometric-gated Keychain items: swift-security (Keychain, CryptoKit, Secure Enclave). Never keep tokens in UserDefaults.
• Device legitimacy / anti-fraud (App Attest, DeviceCheck): device-integrity — pairs with these flows to bind an account to a real device.
• Apple Pay / Wallet passes: passkit. KMP boundary (expose a commonMain AuthService interface, bind an iosMain actual): expect-actual.

Contents