I want to write a CryptoTokenKit plugin to be used to unlock FileVault. I understand macOS already provides such a plugin for a PIV smart card https://support.apple.com/en-mz/guide/deployment/dep806850525/web Perfect. I want to do the same for a non-PIV smart card. So I have to provide my own CryptoTokenKit plugin. I already implemented a smart card plugin TKSmartCardToken. I can use it so pair the user with the smart card and use the smart card to login (except for the 1st login when the disk is still encrypted). As far as I understand for preboot I need to provide a "persistent token" https://support.apple.com/en-mz/guide/deployment/dep4e2622249/web From Xcode I created an empty application, and added a "Persistent Token Extension" (instead of a "Smart Card Token Extension"). After built I can see my new token in the output of "pluginkit -m -p com.apple.ctk-tokens". My questions: how and when is my plugin loaded? I added calls to os_log_error() in all the empty methods created by the Xcode template but I do not find my log messages in the console Apple provides a sample code for an old (2016) PIV token in https://developer.apple.com/library/archive/samplecode/PIVToken/Introduction/Intro.html Is the source code of the PIV token used at pre-boot also available? Thanks