Creating a HaapiAccessor#

HaapiAccessorBuilder is the recommended constructor on iOS:

let baseURL = URL(string: "https://idsvr.example.com")!

let haapiConfiguration = HaapiConfiguration(
    name: "ios-client",
    clientId: "haapi-ios-client",
    baseURL: baseURL,
    tokenEndpointURL: URL(string: "/oauth/v2/oauth-token", relativeTo: baseURL)!,
    authorizationEndpointURL: URL(string: "/oauth/v2/oauth-authorize", relativeTo: baseURL)!,
    appRedirect: "com.example.app://haapi",
    httpHeadersProvider: nil,
    authorizationParametersProvider: nil
)

let haapiAccessor = HaapiAccessorBuilder(haapiConfiguration)
    .buildForHaapi()

let haapiManager = haapiAccessor.haapiManager
let oAuthTokenManager = haapiAccessor.oAuthTokenManager

Dispose of the accessor via haapiAccessor.close() before re-creating it.

Every configured address must use https. buildForHaapi() and buildForOAuth() throw when the base URL, token endpoint, authorization endpoint, a configured revocation endpoint or — when Dynamic Client Registration is configured — client registration endpoint does not, naming the one at fault, and nothing is sent. The error is a HaapiError whose error is insecure_haapi_configuration, with a HaapiInsecureConfigurationRefusal naming the address as its cause. A loopback address such as localhost is not exempt. For a local or test deployment over plain http, create the configuration with the HaapiConfiguration initializer that takes allowInsecureHttpEndpoints: true — the initializer shown above is unchanged and requires https. The flag belongs in development configurations only; it permits an http address to be configured — any other scheme is still refused — while App Transport Security still decides whether the app may send cleartext traffic. Only a HaapiConfiguration can permit http; a HaapiConfigurable of your own always requires https. See HAAPI Request Target Hardening.

HaapiAccessorFactory is the recommended constructor on Android. Create the accessor inside a coroutine because the factory may perform attestation or DCR registration during construction:

val baseURLString = "https://idsvr.example.com"
val baseUri = URI.create(baseURLString)

val haapiConfiguration = HaapiConfiguration(
    keyStoreAlias = "haapi-android-key",
    clientId = "haapi-android-client",
    baseUri = baseUri,
    tokenEndpointUri = URI.create("$baseURLString/oauth/v2/oauth-token"),
    authorizationEndpointUri = URI.create("$baseURLString/oauth/v2/oauth-authorize"),
    appRedirect = "com.example.app://haapi"
)

GlobalScope.launch(Dispatchers.IO + coroutineExceptionHandler) {
    val haapiAccessor = HaapiAccessorFactory(haapiConfiguration)
        .createForHaapi(onCoroutineContext = this.coroutineContext)

    val haapiManager = haapiAccessor.haapiManager
    val oAuthTokenManager = haapiAccessor.oAuthTokenManager
}

Every configured address must use https. createForHaapi() and createForOAuth() throw when the base URL, token endpoint, authorization endpoint, a configured revocation endpoint or — when Dynamic Client Registration is configured — client registration endpoint does not, naming the one at fault, and nothing is sent. The error is an IdsvrHaapiException.Unrecoverable whose error is insecure_haapi_configuration, with a HaapiInsecureConfigurationRefusal naming the address as its cause. A loopback address is not exempt. For a local or test deployment over plain http, set allowInsecureHttpEndpoints = true — it defaults to false and belongs in development configurations only; it permits an http address to be configured — any other scheme is still refused — while the app’s network security configuration still decides whether it may send cleartext traffic. Only a HaapiConfiguration can permit http; a HaapiConfigurable of your own always requires https. See HAAPI Request Target Hardening.

initializeForHaapi is the async factory on React Native. It builds the native iOS or Android accessor across the bridge and returns a HaapiAccessor carrying both managers:

import {
    initializeForHaapi,
    createHaapiConfiguration,
    createIOSConfiguration,
    createAndroidConfiguration,
    noAuthentication,
    getRNLogger,
    RNLogLevel,
} from '@curity/identityserver-haapi-react-native-sdk'

const haapiConfiguration = createHaapiConfiguration({
    baseUrl: 'https://idsvr.example.com',
    tokenEndpointUrl: 'https://idsvr.example.com/oauth/v2/oauth-token',
    authorizationEndpointUrl: 'https://idsvr.example.com/oauth/v2/oauth-authorize',
    iosConfig: createIOSConfiguration({
        clientId: 'haapi-ios-client',
        appRedirect: 'com.example.app://haapi',
        clientAuthenticationMethodConfig: noAuthentication(),
    }),
    androidConfig: createAndroidConfiguration({
        clientId: 'haapi-android-client',
        appRedirect: 'com.example.app://haapi',
        clientAuthenticationMethodConfig: noAuthentication(),
    }),
})

const accessor = await initializeForHaapi(
    haapiConfiguration,
    getRNLogger({ logLevel: RNLogLevel.Info, isSensitiveValueMasked: true })
)

const { haapiManager, oauthTokenManager } = accessor

Dispose of the accessor via accessor.close() before re-initialising; initializeForHaapi throws with HaapiErrorCode.AccessorAlreadyInitialized if an accessor is already held.

• .buildForHaapi() — returns a HaapiAccessor with both managers. Use for a full authorization flow.
• .buildForOAuth() — returns an OAuthAccessor with only OAuthTokenManager. Use for token-only operations (refresh, revoke) — for example, from an App Extension that cannot run the full HAAPI flow.

• .createForHaapi(...) — returns a HaapiAccessor with both managers. Use for full authorization flows (and for DCR fallback — see DCR).
• .createForOAuth() — returns an accessor with only OAuthTokenManager. Use for token-only operations from app widgets that cannot run the full HAAPI flow.

The single-argument .create(...) is deprecated and will be removed in a future major release; use .createForHaapi(...) instead.

• initializeForHaapi(config, logger?) — returns a HaapiAccessor with both managers. Use for a full authorization flow.
• initializeForOAuth(config, logger?) — returns an OAuthAccessor with only oauthTokenManager. Use for token-only operations (refresh, revoke) without running the HAAPI flow.

DCR fallback does not require a separate factory — pass a dcrConfiguration inside createIOSConfiguration / createAndroidConfiguration and continue to use initializeForHaapi (see DCR).