OAuthTokenManager#

let code = authResponseStep.oauthAuthorizationResponseProperties.code!

oAuthTokenManager.fetchAccessToken(with: code) { [weak self] tokenResponse in
    self?.handleTokenResponse(tokenResponse)
}

private func handleTokenResponse(_ tokenResponse: TokenResponse) {
    switch tokenResponse {
    case let .successfulToken(success):
        let accessToken = success.accessToken
        let refreshToken = success.refreshToken
        // persist tokens to secure storage
    case let .errorToken(errorTokenResponse):
        // handle OAuth-protocol error
        break
    case let .error(anError):
        // handle framework or transport error
        break
    }
}

val code = authResponseStep.properties.code

GlobalScope.launch(Dispatchers.IO + coroutineExceptionHandler) {
    val tokenResponse = oAuthTokenManager.fetchAccessToken(
        authorizationCode = code,
        onCoroutineContext = this.coroutineContext,
        additionalParameters = emptyMap()
    )
    handleTokenResponse(tokenResponse)
}

private fun handleTokenResponse(tokenResponse: TokenResponse) {
    when (tokenResponse) {
        is SuccessfulTokenResponse -> {
            val accessToken = tokenResponse.accessToken
            val refreshToken = tokenResponse.refreshToken
            // persist tokens to secure storage
        }
        is ErrorTokenResponse -> {
            // handle OAuth-protocol error
        }
    }
}

On React Native, fetchAccessToken returns a Promise. SDK failures (network, attestation) reject the Promise — OAuth-protocol errors come back inside the resolved TokenResponse. Catch both surfaces in the same async block:

import { isHaapiError } from 'identityserver.haapi.reactnative.sdk'
import type { OAuthAuthorizationResponseStep, TokenResponse } from 'identityserver.haapi.reactnative.sdk'

const step = response.representation as OAuthAuthorizationResponseStep
const code = step.oauthAuthorizationResponseProperties.code

try {
    const tokenResponse = await accessor.oauthTokenManager.fetchAccessToken(code)
    handleTokenResponse(tokenResponse)
} catch (e) {
    if (isHaapiError(e)) {
        // Network / attestation / DPoP / bridge failure — see Error Handling.
    }
}

function handleTokenResponse(tokenResponse: TokenResponse) {
    if (tokenResponse.responseType === 'success') {
        const accessToken = tokenResponse.accessToken
        const refreshToken = tokenResponse.refreshToken
        // Persist to a secure store (expo-secure-store, react-native-keychain).
    } else {
        // tokenResponse.error / errorDescription — RFC 6749 OAuth error
    }
}

oAuthTokenManager.refreshAccessToken(with: "refresh_token") { [weak self] tokenResponse in
    self?.handleTokenResponse(tokenResponse)
}

GlobalScope.launch(Dispatchers.IO + coroutineExceptionHandler) {
    val tokenResponse = oAuthTokenManager.refreshAccessToken(
        refreshToken = "refresh_token",
        onCoroutineContext = this.coroutineContext
    )
    handleTokenResponse(tokenResponse)
}

const tokenResponse = await accessor.oauthTokenManager.refreshAccessToken('refresh_token')
handleTokenResponse(tokenResponse)

Pass optional extra OAuth parameters as a second argument:

await accessor.oauthTokenManager.refreshAccessToken('refresh_token', {
    scope: 'openid profile',
})

oAuthTokenManager.revokeRefreshToken("refresh_token") { result in
    // handle success or error
}

GlobalScope.launch(Dispatchers.IO + coroutineExceptionHandler) {
    try {
        oAuthTokenManager.revokeRefreshToken(
            refreshToken = "refresh_token",
            onCoroutineContext = this.coroutineContext
        )
        // success — SDK has deleted any token-bound key pair
    } catch (e: OAuthUnrecoverableException) {
        // server returned a 4xx with a parsed OAuth error
    }
}

Two revoke methods, one each for refresh and access tokens. Both return Promise<void> on success and reject with a HaapiError on transport or OAuth-protocol failure:

import { isHaapiError } from 'identityserver.haapi.reactnative.sdk'

try {
    await accessor.oauthTokenManager.revokeRefreshToken('refresh_token')
    // success — SDK has deleted any token-bound key pair
} catch (e) {
    if (isHaapiError(e)) {
        // Server returned an error, or transport failed.
    }
}

// Access tokens can also be revoked explicitly:
await accessor.oauthTokenManager.revokeAccessToken('access_token')

dpop(forAccessToken:) returns the Dpop for the key that token is bound to, read from the SDK’s credential storage.

// Once — after the flow completes, or after an app relaunch:
guard let dpop = try oAuthTokenManager.dpop(forAccessToken: accessToken) else {
    // Not token-bound, or this token was superseded or revoked — see below.
    return
}

// Then per request, passing whichever access token is current:
var request = URLRequest(url: apiURL)
request.addAuthorizationHeader(headerValue: "DPoP \(accessToken)")
request.addDpopHeader(headerValue: try dpop.getHeaderValue(httpMethod: "GET",
                                                           url: apiURL,
                                                           nonce: resourceServerNonce,
                                                           accessToken: accessToken))

nil means no DPoP is bound to that token: either the client is not token-bound, so nothing was ever stored, or the access token has been superseded by a refresh or removed by a successful revocation. In both cases the token cannot be presented with a proof, and the app’s route forward is a fresh authentication. Passing a refresh token also yields nil — the lookup is keyed for access tokens only, so a mistyped argument fails closed rather than handing back a key and inviting the refresh token to be sent to a resource server.

A thrown HaapiError.dpopProofFailure means something different and is worth handling separately: the credential storage could not be read, so whether a DPoP exists is unknown. The cause carries the underlying StorageError — StorageError.unavailable identifies a locked keychain or an unusable access group, which is usually transient. Retrying once the device is unlocked is the right response there; re-authenticating the user is not, since it would fail the same way.

dpopHelper(accessToken) returns the DpopHelper for the DPoP key that access token is bound to, read from the Android Keystore. It is a suspend function because that read is I/O, and it runs on Dispatchers.IO unless you pass another context.

val dpopHelper = oAuthTokenManager.dpopHelper(accessToken) ?: return // no key for this token — see below

val proof = dpopHelper.generateProofToken(
    method = "GET",
    uri = apiUri,
    nonce = resourceServerNonce,
    accessToken = accessToken
)

val connection = (apiUri.toURL().openConnection() as HttpURLConnection).apply {
    requestMethod = "GET"
    setRequestProperty(HttpConstants.Headers.AUTHORIZATION, "DPoP $accessToken")
    setRequestProperty(HttpConstants.Headers.DPOP, proof)
}

null is a read miss: the client has no DPoP binding configured, or that token is not one it holds a key for — a token from elsewhere, or one already replaced by a refresh. Pass the access token you last received; if that still returns null, there is no proof to present and the route forward is a fresh authentication.

A thrown IdsvrHaapiException means something different and is worth handling separately: the Keystore could not be read, so whether a key exists is unknown. It carries error keystore_exception and the underlying failure as its cause — a key invalidated by a device credential change, for example. The distinction exists so a failure that may succeed on a later attempt is not mistaken for an absent key.

UI Layer integrators reach the same lookup through OAuthLifecycle.dpopHelper(widgetConfiguration, accessToken).

Read the header with the Driver Layer’s URLResponse.dpopNonce():

let (data, response) = try await session.data(for: request)
if let http = response as? HTTPURLResponse,
   http.statusCode == 401,
   let freshNonce = response.dpopNonce() {
    resourceServerNonce = freshNonce   // store it for this server, then retry the request
}

The connection to your API is yours, so read the header off it directly — HttpConstants.Headers.DPOP_NONCE holds the name:

if (connection.responseCode == 401) {
    connection.getHeaderField(HttpConstants.Headers.DPOP_NONCE)?.let { freshNonce ->
        resourceServerNonce = freshNonce // store it for this server, then retry the request
    }
}