<!--
{
  "documentType" : "article",
  "framework" : "GSS",
  "identifier" : "/documentation/GSS/credential-management",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Credential Management"
}
-->

# Credential Management

Securely establish connections between endpoints.

## Topics

### Allocation and Deallocation

[`GSSCreateCredentialFromUUID`](/documentation/GSS/GSSCreateCredentialFromUUID(_:))

Creates a credential from a universally unique identifier.

[`gss_add_cred`](/documentation/GSS/gss_add_cred(_:_:_:_:_:_:_:_:_:_:_:))

Adds a new credential element to an existing credential.

[`gss_set_cred_option`](/documentation/GSS/gss_set_cred_option(_:_:_:_:))

Changes a credential option.

[`gss_release_cred`](/documentation/GSS/gss_release_cred(_:_:))

Releases the memory of a credential.

[`gss_destroy_cred`](/documentation/GSS/gss_destroy_cred(_:_:))

Purges a credential from memory.

### Initial Credential Keys

The keys used in the attributes dictionary when acquiring new credentials.

[`kGSSICPassword`](/documentation/GSS/kGSSICPassword)

The value is a string that indicates a password.

[`kGSSICCertificate`](/documentation/GSS/kGSSICCertificate)

The value that indicates a certificate to use with PKINIT/PKU2U.

[`kGSSCredentialUsage`](/documentation/GSS/kGSSCredentialUsage)

The value indicates how to use the credential.

[`kGSSICVerifyCredential`](/documentation/GSS/kGSSICVerifyCredential)

The value indicates whether to validate the credential with a trusted source to ensure there was no machine-in-the-middle attack.

[`kGSSICLKDCHostname`](/documentation/GSS/kGSSICLKDCHostname)

The value is a string indicating the LKDC hostname.

[`kGSSICKerberosCacheName`](/documentation/GSS/kGSSICKerberosCacheName)

The value is a string indicating the name of the cache created for use with the Kerberos mechanism.

[`kGSSICSiteName`](/documentation/GSS/kGSSICSiteName)

The value is a string that is the name of site you are authenticating with, used for load balancing in DNS in Kerberos.

[`kGSSICAppIdentifierACL`](/documentation/GSS/kGSSICAppIdentifierACL)

The value is an array of strings containing the list of bundle ID prefixes allowed to access this credential.

[`kGSSICCreateNewCredential`](/documentation/GSS/kGSSICCreateNewCredential)

The value is a Boolean that indicates whether the caller wants to create a new credential and not overwrite a credential with the same name.

[`kGSSICAppleSourceApp`](/documentation/GSS/kGSSICAppleSourceApp)

The value is a dictionary indicating attributes of the app that the credential is for (only applies to AppVPN).

[`kGSSICVerifyCredentialAcceptorName`](/documentation/GSS/kGSSICVerifyCredentialAcceptorName)

The value is a string indicating the name of the acceptor.

[`kGSSICAuthenticationContext`](/documentation/GSS/kGSSICAuthenticationContext)

The value indicates whether to allow the authentication UI or a context to pass a pre-evaluated authentication context.

### Pseudo Random Constants

[`GSS_C_PRF_KEY_FULL`](/documentation/GSS/GSS_C_PRF_KEY_FULL)

This value indicates using the sub-session key by acceptor, initiator, or the ticket’s session key.

[`GSS_C_PRF_KEY_PARTIAL`](/documentation/GSS/GSS_C_PRF_KEY_PARTIAL)

This value indicates using the sub-session key the initiator or the ticket’s session key.

### Credential Usage Values

The values for use with the credential usage key.

[`kGSS_C_INITIATE`](/documentation/GSS/kGSS_C_INITIATE)

The value that indicates a credential may be used to initiate a context.

[`kGSS_C_ACCEPT`](/documentation/GSS/kGSS_C_ACCEPT)

The value that indicates that a credential may be used to accept a context.

[`kGSS_C_BOTH`](/documentation/GSS/kGSS_C_BOTH)

The value that indicates that a credential may be used to either initiate or accept a context.

### Password Keys

The keys used in the attributes dictionary for the changing passwords.

[`kGSSChangePasswordOldPassword`](/documentation/GSS/kGSSChangePasswordOldPassword)

The value is a string that indicates the old password.

[`kGSSChangePasswordNewPassword`](/documentation/GSS/kGSSChangePasswordNewPassword)

The value is a string that indicates the new password.

### Credential Masks and Macros

[`GSS_C_CRED_PASSWORD`](/documentation/GSS/GSS_C_CRED_PASSWORD)

The value that indicates a password-based credential.

[`GSS_C_CRED_CERTIFICATE`](/documentation/GSS/GSS_C_CRED_CERTIFICATE)

The value that indicates a certificate-based credential.

[`GSS_C_CRED_SecIdentity`](/documentation/GSS/GSS_C_CRED_SecIdentity)

The value that indicates a security identity-based credential.

[`GSS_C_CRED_HEIMBASE`](/documentation/GSS/GSS_C_CRED_HEIMBASE)

The value that indicates a Heimdal-based credential.

[`GSS_C_NO_CREDENTIAL`](/documentation/GSS/GSS_C_NO_CREDENTIAL)

The value that indicates an empty credential object.

[`GSS_C_INDEFINITE`](/documentation/GSS/GSS_C_INDEFINITE)

The value that indicates the maximum permitted lifetime when used in a time request.

[`GSS_C_INITIATE`](/documentation/GSS/GSS_C_INITIATE)

The value that indicates a credential that can initiate a security context.

[`GSS_C_ACCEPT`](/documentation/GSS/GSS_C_ACCEPT)

The value that indicates a credential that can accept a security context.

[`GSS_C_BOTH`](/documentation/GSS/GSS_C_BOTH)

The value that indicates a credential that can both initiate and accept security contexts.

[`GSS_C_OPTION_MASK`](/documentation/GSS/GSS_C_OPTION_MASK)

The masking constant for options.

[`GSS_C_CRED_NO_UI`](/documentation/GSS/GSS_C_CRED_NO_UI)

The value that indicates no UI.

[`gss_auth_identity_t`](/documentation/GSS/gss_auth_identity_t)

A pointer to an opaque object used to manage authentication identities.

[`gss_const_cred_id_t`](/documentation/GSS/gss_const_cred_id_t)

A pointer to an immutable opaque type that you use to exchange a credential object with GSS-API functions.

[`gss_cred_id_t`](/documentation/GSS/gss_cred_id_t)

A pointer to an opaque type that you use to exchange a credential object with GSS-API functions.

[`gss_cred_usage_t`](/documentation/GSS/gss_cred_usage_t)

A credential usage value.

### Acquisition

[`gss_aapl_initial_cred`](/documentation/GSS/gss_aapl_initial_cred(_:_:_:_:_:))

Acquires a new credential using a password or certificate.

[`gss_acquire_cred`](/documentation/GSS/gss_acquire_cred(_:_:_:_:_:_:_:_:))

Acquires a credential for use in establishing a security context.

[`gss_acquire_cred_with_password`](/documentation/GSS/gss_acquire_cred_with_password(_:_:_:_:_:_:_:_:_:))

Acquires a credential for use in establishing a security context using a password.

[`GSSCredentialCopyUUID`](/documentation/GSS/GSSCredentialCopyUUID(_:))

Returns a copy of the universally unique identifier corresponding to a GSS credential.

[`GSSCredentialCopyName`](/documentation/GSS/GSSCredentialCopyName(_:))

Returns the name describing the credential.

[`gss_pseudo_random`](/documentation/GSS/gss_pseudo_random(_:_:_:_:_:_:))

Returns a pseudo-random byte stream for keying.

### Inquiries

[`gss_inquire_cred`](/documentation/GSS/gss_inquire_cred(_:_:_:_:_:_:))

Obtains information about a credential.

[`gss_inquire_cred_by_mech`](/documentation/GSS/gss_inquire_cred_by_mech(_:_:_:_:_:_:_:))

Obtains per-mechanism information about a credential.

[`gss_inquire_cred_by_oid`](/documentation/GSS/gss_inquire_cred_by_oid(_:_:_:_:))

Inquires about a particular characteristic of a credential.

[`GSSCredentialGetLifetime`](/documentation/GSS/GSSCredentialGetLifetime(_:))

Returns the remaining time in seconds before the credential expires.

### Iteration

[`gss_iter_creds`](/documentation/GSS/gss_iter_creds(_:_:_:_:))

Iterates over all credentials.

[`gss_iter_creds_f`](/documentation/GSS/gss_iter_creds_f(_:_:_:_:_:))

Iterates over all credentials with a user context.

### Import and Export

[`gss_import_cred`](/documentation/GSS/gss_import_cred(_:_:_:))

Imports a credential from a token.

[`gss_export_cred`](/documentation/GSS/gss_export_cred(_:_:_:))

Exports a credential to a token.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)