Skip to main content
Skip to navigation

Add authentication to your iOS app

Turn on authentication in the RevenueCat iOS SDK and send the ID token from your identity provider after each sign-in

AIAsk AIChatGPTClaude

This article shows you how to add authentication to your iOS app. You'll turn on authentication in the RevenueCat SDK, listen for authentication events, and send the ID token from your identity provider to RevenueCat after each sign-in. By the end, RevenueCat will identify each Customer from a verified ID token, and your app will hold a RevenueCat access token for that Customer.

📘Private beta

Authentication is in private beta, and its API can change before the general release. Tell us about your use case to get early access, and talk to your RevenueCat contact before you use it in a production app.

Prerequisites​

  • An authentication method in your RevenueCat project for the identity provider that your app uses
  • The RevenueCat iOS SDK version 5.88.0 or later, installed in your app
  • Sign-in with your identity provider working in your app, so that your app can get an ID token
  • Read Authentication for how the identity provider, the method, and the access token fit together

1. Turn on authentication in the SDK​

Import the SDK with @_spi(Internal), then set iamEnabled to true when you configure the SDK.

// Authentication is behind an internal flag during the beta
@_spi(Internal) import RevenueCat

let configuration = Configuration.Builder(withAPIKey: revenueCatAPIKey)
    .with(iamEnabled: true)

Purchases.configure(with: configuration.build())

If your app uses RevenueCat from app extensions, such as widgets, configure the SDK with .with(iamEnabled: true, keychainAccessGroup: "<YOUR_KEYCHAIN_ACCESS_GROUP>") instead. The SDK stores the session in that keychain access group, so your app and its extensions share the same Customer.

When the SDK initializes, it creates an anonymous Customer and starts a session for that Customer. Each sign-in that follows attaches an identity to the Customer. See Anonymous Customers and identities.

2. Listen for authentication events​

Set a delegate on Purchases.shared.authentication to learn when the SDK updates the access token, and when refreshing it fails. Errors from an explicit logIn(using:) call go to its completion handler instead of the delegate.

final class AuthenticationObserver: NSObject, AuthenticationDelegate {
    // The SDK calls this method when refreshing the access token fails
    // outside of an explicit logIn(using:) call
    func authenticatorDidEncounterError(_ error: PublicError) {
        // Treat earlier access tokens as invalid, and ask the Customer to sign in again
    }

    // Optional. The SDK calls this method each time it updates the access token.
    func authenticatorDidUpdateAccessToken(_ newAccessToken: String?) {
        // Send the new access token to your backend, if it needs one
    }
}

// The SDK doesn't retain its delegate. Keep a strong reference, such as a property
// on your app delegate, for as long as you want to receive events.
let authenticationObserver = AuthenticationObserver()
Purchases.shared.authentication.delegate = authenticationObserver

The SDK keeps only a weak reference to the delegate. Your app must keep a strong reference to it, or the delegate is released and stops receiving events.

Most apps don't need to read the access token, because the SDK sends it with each of its own requests. Read it when your app calls your own backend, so that the backend can verify the token and identify the Customer. To read the current access token at any time, use currentAccessToken:

let accessToken = Purchases.shared.authentication.currentAccessToken

3. Send the ID token after each sign-in​

After your identity provider signs the Customer in, pass its ID token to Purchases.shared.authentication.logIn(using:). RevenueCat verifies the token against your authentication method and returns an access token. RevenueCat never receives the Customer's password, only the ID token.

Pick the tab for the provider of your authentication method. The iOS SDK doesn't support Google ID sign-in yet.

Apple returns the ID token as Data, so you can pass it to RevenueCat as it is.

import AuthenticationServices
import SwiftUI

SignInWithAppleButton(.signIn) { request in
    request.requestedScopes = [.email]
} onCompletion: { result in
    switch result {
    case .success(let authorization):
        guard let credential = authorization.credential as? ASAuthorizationAppleIDCredential,
              let tokenData = credential.identityToken else {
            // Apple did not return an ID token
            return
        }
        Purchases.shared.authentication.logIn(using: .signInWithApple(tokenData)) { _, error in
            if let error {
                // Show an authentication error to the Customer
                return
            }
            // The Customer is now identified
        }
    case .failure(let error):
        // Show a sign-in error to the Customer
        break
    }
}

4. Verify the sign-in​

Sign in to your app with a test account. The logIn(using:) completion handler returns no error, and Purchases.shared.authentication.currentAccessToken returns an access token.

If an existing Customer already has the identity that you signed in with, RevenueCat merges the anonymous Customer into the existing one. The purchases of both Customers stay with the existing Customer.

Limitations​

  • Authentication needs iOS SDK version 5.88.0 or later. The feature is behind an internal flag. We are working on support for Android, and support for the hybrid SDKs will follow.
  • Your app must get an ID token from your identity provider before it can authenticate with RevenueCat. RevenueCat does not show a login screen in your app.

Next steps​

Was this page helpful?