iOS Platform Notes#

iOS-specific configuration concerns that don’t fit cleanly into the layer-by-layer pages but matter for a production HAAPI integration. Each note is short and stands alone.

AutoFill for Passkeys#

For iOS Passkeys to autofill the login form, declare webcredentials:idsvr.example.com in the app’s Associated Domains entitlement:

webcredentials:idsvr.example.com

The server-side relying-party origin must match exactly. Missing or mismatched entitlements cause AutoFill to silently skip the form — the user sees the standard keyboard with no Passkey prompt. See Passkeys and WebAuthn Fallback for the rest of the Passkey prerequisites.

ASWebAuthenticationSession vs Default Browser#

When the flow redirects to an external URL (legacy OAuth fallback, certain provider integrations), the UI Layer can present ASWebAuthenticationSession (in-app session that shares cookies with Safari) or hand off to the default external browser. The default is ASWebAuthenticationSession. Toggle via setUseDefaultExternalBrowser(true) on the configuration builder — see Presentation Options .

ASWebAuthenticationSession cannot perform background redirects across app switches; flows that require the user to switch to a partner app (e.g., BankID) and return need either explicit deep-link handling (the framework does this via HaapiDeepLinkManager.shared) or setUseDefaultExternalBrowser(true).

LSApplicationQueriesSchemes#

If the authentication flow launches a third-party app (BankID, banking apps, government-ID apps), declare each target scheme under LSApplicationQueriesSchemes in Info.plist:

<key>LSApplicationQueriesSchemes</key>
<array>
    <string>bankid</string>
    <string>bankid-test</string>
    <!-- one entry per partner app you launch -->
</array>

Without these entries, UIApplication.canOpenURL(_:) returns false and the framework skips the partner-app launch path, falling back to the browser. Apple’s documentation on canOpenURL describes the privacy reasoning.

URL Types for the Redirect#

Register your app’s appRedirect scheme under URL Types in Info.plist so the OS can route inbound deep links back into your app:

<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleURLSchemes</key>
        <array>
            <string>app</string> <!-- matches appRedirect: "app://haapi" -->
        </array>
    </dict>
</array>

The Quickstart ( Quickstart — iOS Step 5) shows the matching application(_:open:url:options:) handler.