Swift SDK authentication - Polygon Developer Docs

Authentication establishes an OMS access credential. Wallet selection then activates a wallet and completes the session. Protected wallet operations require that completed session. Starting any new authentication flow clears the current wallet session and invalidates earlier pending authentication or wallet-selection state. Prefer native ID-token authentication when an iOS provider SDK supplies an OIDC ID token. Your app owns provider setup, consent UI, and token acquisition. Pass the provider token to OMS with the issuer and audience that minted it.

let auth = try await omsWallet.wallet.signInWithOidcIdToken(
    idToken: googleIdToken,
    issuer: "https://accounts.google.com",
    audience: "YOUR_WEB_CLIENT_ID",
    provider: "google",
    providerLabel: "Google"
)

if case .walletSelected(let walletAddress, _, _, _) = auth {
    print("Active wallet:", walletAddress)
}

googleIdToken is an identity-provider input. It is not the wallet ID token returned by getIdToken(), which proves the active OMS wallet to your backend. See sessions and access. The maintained Examples/sdk-demo app in the Swift SDK repository shows Google Sign-In acquiring the provider ID token before calling signInWithOidcIdToken. The default session lifetime is one week. Set sessionLifetimeSeconds from 1 through 2_592_000 when you need a different lifetime.

Use email OTP

Email authentication is a two-step flow. The lifetime is chosen when the OTP is sent and reused when the code is completed.

try await omsWallet.wallet.startEmailAuth(
    email: "user@example.com",
    sessionLifetimeSeconds: 604_800
)

let auth = try await omsWallet.wallet.completeEmailAuth(code: "123456")

With the default automatic selection, auth contains the activated wallet, all wallets returned for the credential, and CredentialInfo for the new access credential.

Use an OIDC redirect

Use redirect authentication when the provider does not supply a token through a native SDK or when you need a browser authorization-code flow.

Fixed Google and Apple relay providers

OMSRelayOIDCProviders.google and .apple are fixed SDK values. Their client IDs, scopes, PKCE mode, authorization parameters, and provider callback URLs are not configurable. Supply only the URL where the OMS relay should return to your app. Start the redirect through the wallet client:

let started = try await omsWallet.wallet.startOIDCRedirectAuth(
    provider: OMSRelayOIDCProviders.google,
    omsRelayReturnURI: "yourapp://auth/callback"
)

Open started.authorizationURL with SwiftUI’s openURL environment action or the authentication browser used by your application. Register yourapp as a URL scheme, or use an associated universal link, before starting the flow.

Route the callback in SwiftUI

Pass incoming URLs directly to the SDK from SwiftUI’s onOpenURL.

ContentView()
    .onOpenURL { url in
        Task {
            let callback = try await omsWallet.wallet.handleOIDCRedirectCallback(
                url.absoluteString
            )

            if case .completed(.walletSelected(let address, _, _, _)) = callback {
                print("Active wallet:", address)
            }
        }
    }

The handler is safe to call for unrelated app links. It returns .notOIDCRedirectCallback for a URL that does not belong to OMS and .noPendingAuth when no matching attempt is stored. If the application also uses other URL-based provider SDKs, route each URL to its owner. After the OMS handler validates the callback URL and OAuth state, it consumes the stored redirect flow before completing authentication. A completed, failed, or canceled callback cannot be reused; start a new redirect flow. Values for walletSelection and sessionLifetimeSeconds passed to startOIDCRedirectAuth are stored with the pending callback. Arguments passed to handleOIDCRedirectCallback override them.

Configure a custom provider

Custom providers use their own callback directly and default to authorization code with PKCE. The app owns this configuration.

let provider = CustomOIDCProviderConfiguration(
    issuer: "https://issuer.example.com",
    clientID: "YOUR_OIDC_CLIENT_ID",
    authorizationURL: "https://issuer.example.com/oauth2/authorize",
    providerRedirectURI: "yourapp://auth/callback",
    provider: "corporate",
    providerLabel: "Corporate SSO",
    scopes: ["openid", "email", "profile"]
)

let started = try await omsWallet.wallet.startOIDCRedirectAuth(
    provider: provider
)

providerRedirectURI is both the OAuth redirect URI and the callback URL expected by the SDK.

Choose a wallet automatically or manually

Automatic selection is the default for every auth method. It activates the first wallet matching .ethereum, or creates one when none exists. Set walletSelection: .manual when your app needs to present a wallet picker.

let auth = try await omsWallet.wallet.signInWithOidcIdToken(
    idToken: googleIdToken,
    issuer: "https://accounts.google.com",
    audience: "YOUR_WEB_CLIENT_ID",
    walletSelection: .manual
)

guard case .walletSelection(let pending) = auth else {
    return
}

if let wallet = pending.wallets.first {
    try await pending.selectWallet(walletId: wallet.id)
} else {
    try await pending.createAndSelectWallet(reference: "primary")
}

PendingWalletSelection is pending, single-use, and held in memory until activation. It is not a completed or restorable wallet session, and protected wallet operations are unavailable until you select or create a wallet. A new auth flow, sign-out, expiry, or a completed selection makes the pending value stale.

​Sign in with OIDC token

​Use email OTP

​Use an OIDC redirect

​Fixed Google and Apple relay providers

​Route the callback in SwiftUI

​Configure a custom provider

​Choose a wallet automatically or manually

Sign in with OIDC token