Swift sessions and access - Polygon Developer Docs

An active session combines a selected wallet with an unexpired OMS credential. The SDK persists completed session metadata and restores it when you create OMSWallet again.

Read restored session state

let omsWallet = try OMSWallet(publishableKey: "YOUR_PUBLISHABLE_KEY")
let session = omsWallet.wallet.session

if let walletAddress = session.walletAddress {
    print("Restored wallet:", walletAddress)
    print("Expires:", session.expiresAt as Any)
    print("Identity:", session.auth?.email as Any)
}

OMSWalletSessionState contains completed-session metadata: walletAddress, expiresAt, and authentication metadata in auth. For OIDC, the metadata identifies .idToken or .redirect, the issuer, optional provider details, and an email when OMS returns one. The request-signing credential is separate. Its non-extractable P-256 private key remains Keychain-managed and is not serialized into OMSWalletSessionState. Restoration succeeds only when the completed metadata is unexpired and its Keychain credential can be restored.

A manual PendingWalletSelection is not completed session metadata. It remains in memory only until your app activates a wallet.

Observe expiration

Expired sessions are not activated. Keep the returned observation alive while you need notifications. The callback runs on MainActor.

let expiryObservation = omsWallet.wallet.addSessionExpiredObserver { event in
    print("Expired wallet:", event.session.walletAddress ?? "unknown")
    print("Expired at:", event.expiredAt)
}

// Cancel when the owner no longer needs notifications.
expiryObservation.cancel()

The event retains the expired session snapshot so you can choose the appropriate reauthentication UI.

List, switch, and create wallets

These operations require the authenticated credential. listWallets() follows all server cursors and returns the complete list.

let wallets = try await omsWallet.wallet.listWallets()

if let secondary = wallets.dropFirst().first {
    let selected = try await omsWallet.wallet.useWallet(
        walletId: secondary.id
    )
    print("Selected:", selected.walletAddress)
}

Create and activate another wallet for the same credential when your product requires one.

let created = try await omsWallet.wallet.createWallet(
    reference: "trading"
)

print("Created:", created.wallet.address)

Both useWallet and createWallet replace the active wallet while preserving the current session expiry and authentication metadata.

Understand access objects

Keep these three objects distinct:

Object	Purpose
Wallet session	Local active-wallet state used by protected SDK operations.
Wallet ID token	Short-lived token returned by OMS for your backend to verify the active wallet.
Access credential	A `CredentialInfo` grant that can make signed requests for the wallet until it expires or is revoked.

The OIDC provider ID token used during authentication is a fourth object: it is app-owned identity proof consumed as auth input, not an OMS wallet token.

Request a wallet ID token

Call getIdToken() only after a wallet is active. Send the returned string to a backend that verifies it using the OMS issuer and JWKS flow described in backend wallet verification.

let walletIdToken = try await omsWallet.wallet.getIdToken(
    ttlSeconds: 3_600,
    customClaims: [
        "role": .string("member")
    ]
)

Custom claims originate in the client. Your backend should not treat them as trusted authorization state unless it controls how they are assigned.

List and revoke access credentials

Use listAccess() to load all credential pages for account-management UI.

let credentials = try await omsWallet.wallet.listAccess()

for credential in credentials {
    print(credential.credentialId)
    print(credential.expiresAt)
    print("Current caller:", credential.isCaller)
}

Use the async sequence when your UI should process one server page at a time.

for try await page in omsWallet.wallet.listAccessPages(pageSize: 25) {
    for credential in page.credentials {
        print(credential.credentialId, credential.isCaller)
    }
}

You can also request one page with listAccessPage(pageSize:cursor:). Revoke only a credential whose isCaller value is false:

if let credential = credentials.first(where: { !$0.isCaller }) {
    try await omsWallet.wallet.revokeAccess(
        targetCredentialId: credential.credentialId
    )
}

Revocation cannot be undone. Revoking the caller invalidates the credential making the current request and prevents subsequent protected operations from that session. Keep caller revocation out of the normal access-management UI.

Sign out

try omsWallet.wallet.signOut()

Signing out clears the completed session, Keychain credential, pending redirect state, and pending wallet selection for this SDK scope. It does not revoke other access credentials on the wallet.

​Read restored session state

​Observe expiration

​List, switch, and create wallets

​Understand access objects

​Request a wallet ID token

​List and revoke access credentials

​Sign out

Read restored session state

Observe expiration

List, switch, and create wallets

Understand access objects

Request a wallet ID token

List and revoke access credentials

Sign out