Ace ID iOS SDK

The AceID Swift Package uses AppAuth-iOS for OIDC authorization. It targets iOS 15 and newer. Version 0.2.3 is not released yet.

Add the package

In Xcode, choose File → Add Package Dependencies and enter:

https://github.com/aceyash-dev/ace-id-sdk

Select the AceID product and choose version 0.2.3 after it is published. The package uses Keychain-backed storage.

Configure a client

import AceID

let configuration = try AceIDConfiguration(
    issuer: URL(string: "https://identity.ace-base.cc")!,
    clientID: "your-public-client-id",
    redirectURI: URL(string: "com.example.app:/oauth/callback")!,
    scopes: ["openid", "profile", "email", "offline_access"]
)
let client = AceIDClient(configuration: configuration)

Register the exact redirect URI with Ace ID and add the corresponding URL scheme to the app target.

Sign in and refresh tokens

Call signIn(presenting:completion:) on the main actor. Forward the redirect URL received by the app or scene delegate to resumeAuthorizationFlow(with:).

client.signIn(presenting: viewController) { result in
    switch result {
    case .success(let session):
        print("Signed in. Token expires at \(session.expirationDate)")
    case .failure(let error):
        print("Sign-in failed: \(error.localizedDescription)")
    }
}

// In the app or scene URL callback:
_ = client.resumeAuthorizationFlow(with: url)

client.validAccessToken { result in
    // Use the token or handle the authentication error.
}

AppAuth handles the authorization state and PKCE exchange. Do not log access or refresh tokens.

Logout and revocation

• signOut(presenting:postLogoutRedirectURI:completion:) uses the discovered end-session endpoint when available and a post-logout URI is supplied. Without that URI, logout is local only.
• revokeTokens(completion:) calls the provider's advertised RFC 7009 endpoint. If the endpoint is unavailable, revocation fails closed.
• clearSession() clears local state only.

The Keychain store uses WhenUnlockedThisDeviceOnly; AppAuth authorization state is archived with secure coding.

Token validation

The SDK verifies RS256 and ES256 ID-token signatures against the issuer's HTTPS JWKS and checks issuer, audience, authorized party, expiration, issued-at time, and the authorization nonce. Unsupported signing algorithms are rejected.

Your API must validate access tokens and enforce permissions independently.

Release status

Do not pin version 0.2.3 or distribute a package archive until the official SDK release is available. See the SDK overview for current status and the source repository for release artifacts.