I'm experiencing a strange issue where ASWebAuthenticationSession works perfectly when running from Xcode (both Debug and Release), but fails on TestFlight builds. The setup: iOS app using ASWebAuthenticationSession for OIDC login (Keycloak) Custom URL scheme callback (myapp://) prefersEphemeralWebBrowserSession = false The issue: When using iOS Keychain autofill (with Face ID/Touch ID or normal iphone pw, that auto-submits the form) -> works perfectly When manually typing credentials and clicking the login button -> fails with white screen When it fails, the form POST from Keycloak back to my server (/signin-oidc) never reaches the server at all. The authentication session just shows a white screen. Reproduced on: Multiple devices (iPhone 15 Pro, etc.) iOS 18.x Xcode 16.x Multiple TestFlight testers confirmed same behavior What I've tried: Clearing Safari cookies/data prefersEphemeralWebBrowserSession = true and false Different SameSite cookie policies on server Verified custom URL scheme is registered and works (testing myapp://test in Safari opens the app) Why custom URL scheme instead of Universal Links: We couldn't get Universal Links to trigger from a js redirect (window.location.href) within ASWebAuthenticationSession. Only custom URL schemes seemed to be intercepted. If there's a way to make Universal Links work in this context, without a manual user-interaction we'd be happy to try. iOS Keychain autofill works The only working path is iOS Keychain autofill that requires iphone-authentication and auto-submits the form. Any manual form submission fails, but only on TestFlight - not Xcode builds. Has anyone encountered this or know a workaround?

Hi everyone, I'm currently working on a native macOS app (built with SwiftUI) and I'm trying to implement Password AutoFill functionality so users can use their saved credentials from Keychain or third-party password managers. I've gone through Apple's documentation, WWDC sessions, and sample code, but I've noticed that the resources primarily focus on iOS and web implementations. There's very limited guidance specifically for macOS. I've set up: Associated Domains entitlement with the webcredentials: service The apple-app-site-association file on my server TextField with .textContentType(.username) and SecureField with .textContentType(.password) However, I'm still not seeing the expected AutoFill behavior on macOS like I would on iOS. Has anyone successfully implemented Password AutoFill on a native macOS app? Are there any macOS-specific considerations or additional steps required that differ from iOS? Any guidance, sample code, or pointers to documentation I might have missed would be greatly appreciated.

I noticed, that even though my AutoFill Credential Provider Extension works with Safari for both Passwords and Passkeys, it doesn't work in context menus inside arbitrary textfields, meanwhile the same is true for the Apple Passwords app. This is a great hit to AutoFill productivity, as my extension is unable to fill textfields by just going to the context menu and clicking AutoFill > Passwords.. Is this a feature only available to Apple via private APIs, or is this something I can interface with? I checked and the Passwords app does use some undocumented but non-private entitlements: [Key] com.apple.authentication-services.access-credential-identities [Value] [Bool] true I also checked the responsible executable for some hints (AutoFillPanelService) however found nothing that would lead me to believe this is a public extension point. Another idea I had was trying to use a macOS Service for this, however Services in the "General" category won't show up in any context menu, only in the Application's Main Menu.

Hello I am trying to release an application using EXPO ROUTER + EXPO RN WEB. I am trying to implement Apple Login using Firebase. I have already put necessary info in both App Store Connect and Firebas console. Now I am so confused what I have to do next. What are some resource I could use or tips you could possibly give me when making apple login available using firebase. Pleas all helps are welcomed and needed

We have encountered a consistent problem with OTP (One Time Password) autofill on iOS versions 26.0.1 through 26.3. The issue pertains to apps implementing OTP input using multiple UITextFields (often 6 or 7 separate text boxes for each digit). Problem Details: When tapping the OTP autofill suggestion from Messages or supported third-party apps, iOS autofill pastes the entire OTP string into just one UITextField (commonly the second or focused field) rather than distributing digits across the individual text fields. The delegated UITextField methods such as textField:shouldChangeCharactersInRange:replacementString: receive an entire OTP string at once, but the usual event handlers like UIControlEventEditingChanged do not always trigger, breaking existing logic relying on those. This results in the OTP input UI showing incorrect or partial OTP, confusing users and forcing manual re-entry. Many popular apps employing multi-field OTP input UIs face similar autofill malfunctions on iOS 26.x, impacting user experience negatively. Setting textContentType = .oneTimeCode on the first text field alone is insufficient to restore the intended autofill behavior on iOS 26.x. This represents a regression or functional deficiency compared to iOS 15-18 autofill handling patterns, which worked reliably for these multi-field OTP UIs.| Expected Behavior: OTP autofill should either automatically split the filled code into each UITextField or trigger consistent delegate/callback events to enable developers to replicate this behavior manually. textDidChange or equivalent events should fire on autofill updates to reflect text changes correctly in multi-field OTP input. Apple’s OTP autofill system should transparently support or provide clear guidelines for handling multi-field OTP input on iOS 26+. What We’ve Tried: Setting .oneTimeCode content type on only the first UITextField. Handling OTP autofill in delegate methods including shouldChangeCharactersInRange. Manual distribution and custom logic triggered by textDidChange and other callbacks. Confirming all relevant system autofill settings are enabled. Testing on multiple devices and iOS versions (26.0.1 through 26.3). Note: its happen for may apps which have text field with 6 box otp fill

Issue Summary: On iOS 26.0.1 to 26.3, apps using multiple UITextFields for OTP input face a critical issue where the system autofill pastes the entire OTP string into a single text field, usually the focused one, rather than splitting digits across fields. Delegate events like textDidChange: do not trigger consistently on autofill, breaking existing input handling logic. Expected Behavior: OTP autofill should distribute each digit correctly across all OTP UITextFields. Delegate or control events should fire on autofill to enable manual handling. (BOOL)textField:(UITextField *)textField shouldChangeCharactersInRange:(NSRange)range replacementString:(NSString *)string { if (string.length > 1) { // Autofill detected - distribute OTP manually for (int i = 0; i < string.length && i < self.arrayOTPText.count; i++) { UITextField *field = self.arrayOTPText[i]; field.text = [NSString stringWithFormat:@"%c", [string characterAtIndex:i]]; } UITextField *lastField = self.arrayOTPText[string.length - 1]; [lastField becomeFirstResponder]; return NO; } // Handle normal single character or deletion input here return YES; } // // Setup UITextFields - set .oneTimeCode on first field only for (int i = 0; i < self.arrayOTPText.count; i++) { UITextField *field = self.arrayOTPText[i]; field.delegate = self; if (@available(iOS 12.0, *)) { field.textContentType = (i == 0) ? UITextContentTypeOneTimeCode : UITextContentTypeNone; } } What We’ve Tried: Setting textContentType properly. Handling OTP distribution in delegate method. Verifying settings and keyboard use. Testing on multiple iOS 26.x versions. Impact: Major usability degradation during OTP entry. Forces fragile workarounds. Inconsistent autofill reduces user confidence. Request: Request Apple fix OTP autofill to natively support multi-field UITextField OTP input or provide enhanced delegate callbacks for consistent behavior. Did any one face this issue in recent time with iOS 26.0.1 to 26.3 beta version

Hi Apple, Currently we want to have enhancement for SMS OTP that we want to implement OTP Autofill, But after do some research we're stuck with option that the OTP only show in keyboard suggestion, is there any way for making OTP is automatically filled without user have to click the keyboard suggestion when receiving the SMS. Thanks Best Regards, Admiral Sultano Harly.

My IOS app generates pdf files. Every time my users open the generated pdf files, the autofill popup jumps out, but my pdf file is NOT for interacting. I'm here to ask if there's a way to mark my pdf files as "not a form", like in metadata or anywhere else?

I have a project with a single app target that serves two environments, and two schemes, one for each env, using xcconfig files for defining environment-specific stuff. I'm trying to figure this out for months, so I've tried multiple approaches throughout this period: Have a single domain in "Associated domains" in Xcode, defined as webcredentials:X where X gets replaced using a value from xcconfig. Have two domain entries in "Associated domains" webcredentials:PROD_DOMAIN and webcredentials:STAGING_DOMAIN. Have a different order of domains Results are very interesting: whatever I do, whatever approach I take, password autofill works on staging, but doesn't work on production. I'm aware that we need to test production on Test Flight and AppStore builds. That's how we're testing it, and it's not working. Tested on multiple devices, on multiple networks (wifi + mobile data), in multiple countries.. you name it. The server side team has checked their implementation a dozen times; it's all configured properly, in the exact same way across environments (except bundle ID, ofc). We tried a couple websites for validating the apple-app-site-association file, and while all of those are focused on testing universal links, they all reported that the file is configured properly. Still, password autofill doesn't work. I prefer not to share my app's domains publicly here. Ideally I would contact Apple Developer Support directly, but they now require a test project for that, and since 'a test project' is not applicable to my issue, I'm posting here instead.

On iOS when I run my Autofill extension target from Xcode and attach to Safari, Swift print() statements appear in the Xcode console log. If I run the same extension on MacOS Sequoia, no log messages appear. The header strip in the debugger area remains blank. Anyone know how to see these log messages? In both cases, the scheme is set to Debug build, and "Debug Executable" is not selected. In fact, for iOS the "Debug Executable" is grayed out. When I set Debug Executable on the MacOS run, I get failure to attach with a warning about permission to debug Safari.

I'm trying to use the new (in tvOS 26) video streaming service automatic login API from the VideoSubscriberAccount framework: https://developer.apple.com/documentation/videosubscriberaccount/vsuseraccountmanager/autosignintoken-swift.property It seems that this API requires an entitlement. This document suggests that the com.apple.smoot.subscriptionservice entitlement is required. https://developer.apple.com/documentation/videosubscriberaccount/signing-people-in-to-media-apps-automatically However, it seems more likely that com.apple.developer.video-subscriber-single-sign-on is the correct entitlement. https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.video-subscriber-single-sign-on Which is the correct entitlement and how do I obtain it? I don't want to fully comply with the video partner program. https://developer.apple.com/programs/video-partner/ I just want to use this one new automatic login feature.

Good morning everyone! I have an issue with AutoFillExtension. I think that my integration is correct but I don't see the page with the list. I'm developing a password manager and I see the name of the app in Default Pass in Settings, I see the name of my app when I tap on key to choose credentials but when I tap on my app... don't see anything. Came back Password. Somebody have a list or a tutorial to implement this extension? Thanks 😔

Using the simplified sign-in with tvOS and a third party password manager, I receive a complete ASPasswordCredential, and I can easily log into my app. When I do the same thing but with Apple's password manager as the source, I receive an ASPasswordCredential that includes the email address, but the password is an empty string. I have tried deleting the credentials from Apple Passwords and regenerating them with a new login to the app's website. I have tried restarting my iPhone. Is this the expected behavior? How should I be getting a password from Apple's Password app with an ASAuthorizationPasswordRequest?

We implemented a feature to receive name and email address after Sign in with Apple, and it works perfectly in our testing. However, during the app review, they says it doesn't work, and the app is rejected. Why does it work differently?

we develop extension "Autofill Credential Provider" function for passkey. 1.first step registe passkey 2.second step authenticate with passkey step 1 &amp; step 2 has finished and run success with provideCredentialWithoutUserInteraction. But we want to prepare our interface for use to input password and select passkey what the want. however the func prepareInterfaceToProvideCredential in ASCredentialProviderViewController does call? what i missed? how can i do it?

After registe Passkey with webauthn library, i create a passkeyRegistration with follow, let passkeyRegistration = ASPasskeyRegistrationCredential(relyingParty: serviceIdentifier, clientDataHash: clientDataHashSign, credentialID: credentialId, attestationObject: attestationObject) and then completeRegistrationRequest like that, extensionContext.completeRegistrationRequest(using: passkeyRegistration) But a bad outcome occurred from user agent. NotAllowedError:The request is not allowed by the user agent or the platform in the current context. And the return data rawID & credentialPublicKey is empty,

override func prepareInterface(forPasskeyRegistration registrationRequest: any ASCredentialRequest) int this function how can i get the "challenge" from user agent, the params "challenge" need to be used in webauthn navigator.credentials.create

Without developer mode, I was able to get Password AutoFill to work in my SwiftUI app with my local Vapor server using ngrok and adding the Associated Domains capability with the value webcredentials:....ngrok-free.app and the respective apple-app-site-association file on my local server in /.well-known/. (works on device, but not in the simulator). However, if I use the developer mode (webcredentials:....ngrok-free.app?mode=developer) it only works halfway when running from Xcode: I get asked to save the password, but the saved passwords are not picked up, when I try to login again. Neither on device, nor in the simulator. If I remove the ?mode=developer it seems to work as expected. Is this by design, or am I missing something? var body: some View { ... Section(header: Text("Email")) { TextField("Email", text: $viewModel.credentials.username) .textContentType(.username) .autocapitalization(.none) .keyboardType(.emailAddress) } Section(header: Text("Passwort")) { SecureField("Passwort", text: $viewModel.credentials.password) .textContentType(.password) } ... }

Since release of 18.4. prepareInterfaceToProvideCredential .oneTimeCode case is not called and instead prepareInterfaceForUserChoosingTextToInsert() is called. That is the wrong delegate for this case and it causes confusion for the users. Also, some TOTP fields are recognised however, the key icon button is not presented above the keyboard next to TOTP suggestions. I've also tested 18.5 and it has the same issue. provideOneTimeCodeWithoutUserInteraction works just fine.

I’m having an issue with my Credential Provider Extension for passkey registration. On the browser I click on registration, in IOS i can select my App for passkey registration with a continue button. Wenn I click the continue button the prepareInterface(forPasskeyRegistration:) function is called but the MainInterface is not shown —it only appears when I click the continue button a second time. Here’s a simplified version of my prepareInterface method: override func prepareInterface(forPasskeyRegistration registrationRequest: ASCredentialRequest) { guard let request = registrationRequest as? ASPasskeyCredentialRequest, let identity = request.credentialIdentity as? ASPasskeyCredentialIdentity else { extensionContext.cancelRequest(withError: ASExtensionError(.failed)) return } self.identity = identity self.request = request log.info("prepareInterface called successfully") } In viewDidAppear, I trigger FaceID authentication and complete the registration process if register is true. However, the UI only shows after a second “Continue” tap. Has anyone encountered this behavior or have suggestions on how to ensure the UI appears immediately after prepareInterface is called? Could it be a timing or lifecycle issue with the extension context? Thanks for any insights!