We ship a credential provider extension (ASCredentialProviderViewController, ProvidesPasskeys = true) backed by a USB CCID smart card token. It works on iOS 26.6. On iOS 27.0, TKSmartCard.beginSession() inside the extension never returns during a passkey request. The CryptoTokenKit log shows why. When a passkey request starts, AuthenticationServicesAgent takes an exclusive session on the reader to check whether it is a hardware security key. The check takes about 7 ms and comes back negative — our token has no FIDO applet. The agent then keeps the session for the rest of the request anyway. Our extension asks for the card 0.2 s later and gets queued behind it: 14:24:13.687776 usbsmartcardreaderd session requested by pid 2116 (1 now queued) 14:24:13.687793 usbsmartcardreaderd session busy (held by pid 2095); notifying holder 14:24:13.687849 AuthenticationServicesAgent got request for used session, setting flag to release it ASAP 14:24:34.884294 AuthenticationServicesAgent got request for used session, setting flag to release it ASAP 14:25:19.851779 AuthenticationServicesAgent got request for used session, setting flag to release it ASAP 14:26:12.501296 AuthenticationServicesAgent endSession 14:26:12.502320 usbsmartcardreaderd session granted to pid 2116 pid 2095 is the agent, pid 2116 is our extension. The system tells the holder three times that someone is waiting; it is released 118.8 s later, when the passkey request itself times out — by which point the card is useless to us. So it deadlocks: the agent holds the card until the request finishes, and the request cannot finish until we get the card to sign the assertion. One detail suggests this is not deliberate. The agent takes the session twice in a row and runs the identical check both times. The first one it releases after a second; the second one is the one that sticks. We saw the same pattern on two different days. We have not found any point in the request where the card is free. Things that do not work: grabbing it as early as viewDidLoad; grabbing it in provideCredentialWithoutUserInteraction before any UI appears; holding it in the containing app and handing it over once the extension starts (the queue is FIFO and the agent is ahead of us); and simply waiting, since the block lasts exactly as long as the request does. Has anyone else hit this? Has anyone shipped a smart-card-backed credential provider on iOS 27 and found a way around it? Is there any way to stop the system from claiming an attached reader while a passkey request is in flight — a setting, an Info.plist key, something on the relying party side, anything at all? We would happily take an ugly workaround at this point. And if you hit this and got nowhere either, that is useful to hear too — it would tell us this is not specific to our token. Questions Once the check has come back negative, the reader is known not to be a security key. Is there a supported way to make the agent release it at that point, or for an extension to declare that it needs exclusive access? Can this be turned off from Safari or from the relying party side? For an assertion (navigator.credentials.get): does hints: ["client-device"], or leaving usb out of transports in allowCredentials, stop the agent from claiming the reader? If so, that is a real mitigation for anyone who controls their own relying party. (authenticatorSelection.authenticatorAttachment only exists on registration options, so it is not available here.) Is TKSmartCard.beginSession() meant to block indefinitely, with no timeout and no cancellation? It bridges beginSessionWithReply:, so Swift concurrency cancellation does not reach it either. Failing with an error after a bounded wait would at least make this diagnosable instead of presenting as a hang. Filed as FB24171032 with a minimal sample project and full logs. Hardware, in case it matters: Aktiv Rutoken ECP, USB CCID. Any CCID reader without a FIDO applet should behave the same. iPhone 15 Pro on iOS 27.0 fails; iPhone 17 Pro on iOS 26.6 works, same binary and same token.

I can't seem to find information on this but this is causing a critical bug where the Strong Password suggestion sheet presents on any secure field (UIKit) and clears the others when closing it. This means the user cannot enter a password when there is a secure confirm password field because switching fields clears the other. This looks to be a recent issue but I can't tell when this was introduced or if this is SDK / OS version related. I am finding it in both Xcode 26.2 and 16.4 when running on device (iOS 26.2.1 and XC 26 simulators). Code to reproduce: class ViewController: UIViewController { override func loadView() { let v = UIStackView() v.axis = .vertical v.layoutMargins = .init(top: 16, left: 16, bottom: 16, right: 16) v.isLayoutMarginsRelativeArrangement = true view = v let t1 = UITextField() t1.textContentType = .username t1.placeholder = "Username" v.addArrangedSubview(t1) let t2 = UITextField() t2.isSecureTextEntry = true t2.textContentType = .newPassword t2.placeholder = "Password" t2.clearsOnInsertion = false t2.clearsOnBeginEditing = false t2.passwordRules = nil t2.clearButtonMode = .always v.addArrangedSubview(t2) let t3 = UITextField() t3.isSecureTextEntry = true t3.textContentType = .newPassword t3.placeholder = "Confirm Password" t3.clearsOnInsertion = false t3.clearsOnBeginEditing = false t3.passwordRules = nil t3.clearButtonMode = .always v.addArrangedSubview(t3) v.addArrangedSubview(UIView()) } } No matter what textContentType is used the strong password still forcefully breaks the flow and blocks the user.

I'm trying to diagnose some issues with my AutoFill credential provider not loading on macOS. As far as I can tell I have all the entitlements and provisioning profiles correct, and ASSettingsHelper.requestToTurnOnCredentialProviderExtension() returns true with the Credential Provider showing up enabled in System Settings. However all other attempts to call into AuthenticationServices fail, and ASCredentialIdentityStore.shared.getState() always returns false for state.isEnabled Looking at the logs I don't see anything that stands out but I am not sure I've got the correct filter on the logs. I see discovery taking place 2026-05-29 08:43:09.389967-0700 0xd7d00 Default 0x83c0b1 26490 0 CredentialProviderExtensionHelper: (PlugInKit) [com.apple.PlugInKit:discovery] [d 88616305-672E-4143-81A6-832522BCD790] <PKHost:0x7e6c24900> Beginning discovery for flags: 0, point: com.apple.authentication-services-credential-provider-ui 2026-05-29 08:43:09.390070-0700 0xd7d00 Info 0x83c0b1 26490 0 CredentialProviderExtensionHelper: (PlugInKit) [com.apple.PlugInKit:discovery] [d 88616305-672E-4143-81A6-832522BCD790] <PKHost:0x7e6c24900> Query: { "LS:ExtensionPlatforms" = ( 1, 6, 2 ); NSExtensionPointName = "com.apple.authentication-services-credential-provider-ui"; NSUserElection = 1; } 2026-05-29 08:43:09.392893-0700 0xd79ee Debug 0x83c0b1 487 0 pkd: (PlugInKit) [com.apple.PlugInKit:sandbox] issued file extension for [/Applications/test.app/Contents/PlugIns/testIDCredentialProvider.appex] 2026-05-29 08:43:09.392936-0700 0xd79ee Debug 0x83c0b1 487 0 pkd: (PlugInKit) [com.apple.PlugInKit:ls] [u C85BFC1E-25E1-4917-A1D8-0123013482EE] [com.myapp.test.App.testid-credential-provider(7.35)] info [CFBundleIdentifier] => [com.myapp.test.App.testid-credential-provider] 2026-05-29 08:43:09.392947-0700 0xd79ee Debug 0x83c0b1 487 0 pkd: (PlugInKit) [com.apple.PlugInKit:sandbox] issued mach extension for [com.myapp.test.App.testid-credential-provider] And I see it being discovered correctly: 2026-05-29 08:43:09.394535-0700 0xd7d00 Default 0x83c0b2 26490 0 CredentialProviderExtensionHelper: (ExtensionFoundation) [com.apple.extensionkit:NSExtension] discovered extensions: attributes { "LS:ExtensionPlatforms" = ( 1, 6, 2 ); NSExtensionPointName = "com.apple.authentication-services-credential-provider-ui"; NSUserElection = 1; }, extensionSet {( <EXConcreteExtension: 0x7e71b41c0> {id = com.myapp.test.App.testid-credential-provider} )} I don't see any errors related to security or provisioning that I can tell. Any tricks I can use to see why I can't use my Credential Provider?

I am using SwiftUI's native SecureField. When a user types their password manually, the dots render correctly in both light and dark mode. However, when iOS suggests and autofills a strong generated password, the dots become invisible in dark mode. Switching to light mode shows that they are there. Is there a supported way to force SecureField to re-render its secure entry dots correctly after iOS fills in a strong generated password in dark mode? import SwiftUI let warmMustard = Color(red: 0.780, green: 0.659, blue: 0.290) let lightText = Color(red: 0.973, green: 0.961, blue: 0.933) let darkText = Color(red: 0.118, green: 0.118, blue: 0.118) struct SecureFieldTestView: View { @Environment(\.colorScheme) var colorScheme @State private var username = "" @State private var password = "" @State private var confirmPassword = "" var body: some View { ZStack { Color(colorScheme == .dark ? UIColor.black : UIColor.white) .ignoresSafeArea() VStack(spacing: 20) { Text("Dark mode dot reproduction") .foregroundColor(colorScheme == .dark ? .white : .black) TextField("Username", text: $username) .textContentType(.username) .autocorrectionDisabled() .textInputAutocapitalization(.never) .padding() .background(colorScheme == .dark ? Color.black : Color.white) .cornerRadius(8) .foregroundColor(colorScheme == .dark ? .white : .black) .overlay(RoundedRectangle(cornerRadius: 8).stroke(warmMustard, lineWidth: 2)) SecureField("Password", text: $password) .textContentType(.newPassword) .padding() .background(colorScheme == .dark ? Color.black : Color.white) .cornerRadius(8) .foregroundColor(colorScheme == .dark ? .white : .black) .overlay(RoundedRectangle(cornerRadius: 8).stroke(warmMustard, lineWidth: 2)) SecureField("Confirm Password", text: $confirmPassword) .textContentType(.newPassword) .padding() .background(colorScheme == .dark ? Color.black : Color.white) .cornerRadius(8) .foregroundColor(colorScheme == .dark ? .white : .black) .overlay(RoundedRectangle(cornerRadius: 8).stroke(warmMustard, lineWidth: 2)) } .padding(.horizontal, 32) } } } #Preview { SecureFieldTestView() }

Hi Apple Developer Community, Quick question — is there currently a way to disable the “Save Password” prompt in iOS while keeping AutoFill enabled? From what I can see, the only available setting under Settings → Passwords → Password Options controls AutoFill as a whole, with no option to turn off just the save prompt. I’m using a third-party password manager and would prefer to keep AutoFill but avoid the repeated prompts to save credentials. Has anyone found a workaround for this, or is this simply not configurable at the moment? Thanks!

Hi Apple Developer Community, Quick question — is there currently a way to disable the “Save Password” prompt in iOS while keeping AutoFill enabled? From what I can see, the only available setting under General → AutoFill & Passwords controls AutoFill as a whole, with no option to turn off just the save prompt. I’m using a third-party password manager and would prefer to keep AutoFill but avoid the repeated prompts to save credentials. Has anyone found a workaround for this, or is this simply not configurable at the moment? Thanks!

I’m seeing a weird iOS Password AutoFill behavior in React Native and I’m trying to figure out whether this is: expected iOS behavior, a known React Native TextInput issue, or something I can work around. Setup: React Native 0.81.5 iOS app with Associated Domains configured and working Password AutoFill generally works fine two fields on a login screen: username/email: autoComplete="username" password: autoComplete="current-password" What happens: when the login screen opens, the iOS autofill bar above the keyboard shows the saved credential suggestion as expected as soon as I type a single character into the username field, the autofill bar goes blank instead of continuing to show a suggestion if I press delete while the field is already empty, the autofill suggestion flickers Important detail: autofill itself is not completely broken Associated Domains are set up and credential suggestions do appear the issue is specifically the unstable behavior of the autofill bar while editing Question: has anyone seen this with React Native TextInput on iOS? is this just how iOS reevaluates credential suggestions once the username starts changing? or is there a known RN-side trigger here, for example controlled inputs, secureTextEntry, rerenders, focus changes, or textContentType / autoComplete combinations?

Hello, I'm currently investigating an issue related to iOS credit card autofill (Payments & Card Details) in our mobile application. Our app is built using React Native, and we are implementing card input fields using TextInput with the required autofill configuration: autoComplete="cc-number" textContentType="creditCardNumber" Despite correctly configuring these properties, credit card autofill is not being triggered on iOS devices. I would appreciate clarification on: Is credit card autofill officially supported for React Native TextInput fields using autoComplete="cc-number" and textContentType="creditCardNumber"? Are there any additional requirements (entitlements, associated domains, specific configurations, etc.) needed for payment autofill to work? Is autofill expected to work inside WKWebView contexts? Are there any known limitations or restrictions for third-party frameworks such as React Native? I would appreciate any guidance or documentation you can share regarding the expected behavior and official support for this scenario

Hello there, Credit card autofill works in Safari when accessing the checkout on my website, but does NOT work when the same page is loaded in a WKWebView within the my iOS mobile app. is there any way I can make it work?

When using the Password AutoFill feature, after entering a password and navigating to another page, a system prompt appears asking whether to save the password to the keychain (as shown in the figure). If this prompt is not dismissed and the app is moved to the background, then brought back to the foreground, the prompt automatically disappears. However, after this occurs, all input fields within the app become unresponsive to keyboard input—no keyboard will appear when tapping any text field. The only way to restore keyboard functionality is to force-quit the app and relaunch it. How can this issue be resolved?

We have a native iOS app built with UIKit, and we are experiencing issues with credit card autofill when using the keyboard Quick Type bar. We have reviewed the documentation on Associated Domains, but we haven’t found anything that specifically addresses our issue. Our goal is to autofill all credit card details-including the CVV-in a single step, rather than one field at a time

After registe Passkey with webauthn library, i create a passkeyRegistration with follow, let passkeyRegistration = ASPasskeyRegistrationCredential(relyingParty: serviceIdentifier, clientDataHash: clientDataHashSign, credentialID: credentialId, attestationObject: attestationObject) and then completeRegistrationRequest like that, extensionContext.completeRegistrationRequest(using: passkeyRegistration) But a bad outcome occurred from user agent. NotAllowedError:The request is not allowed by the user agent or the platform in the current context. And the return data rawID & credentialPublicKey is empty,

Hello I am trying to release an application using EXPO ROUTER + EXPO RN WEB. I am trying to implement Apple Login using Firebase. I have already put necessary info in both App Store Connect and Firebas console. Now I am so confused what I have to do next. What are some resource I could use or tips you could possibly give me when making apple login available using firebase. Pleas all helps are welcomed and needed

Hello, I know that apps with Safari extension need to be distributed on App Store, I wonder if it's also the case for AutoFill extension. Thanks in advance for your answer!

Issue Summary: On iOS 26.0.1 to 26.3, apps using multiple UITextFields for OTP input face a critical issue where the system autofill pastes the entire OTP string into a single text field, usually the focused one, rather than splitting digits across fields. Delegate events like textDidChange: do not trigger consistently on autofill, breaking existing input handling logic. Expected Behavior: OTP autofill should distribute each digit correctly across all OTP UITextFields. Delegate or control events should fire on autofill to enable manual handling. (BOOL)textField:(UITextField *)textField shouldChangeCharactersInRange:(NSRange)range replacementString:(NSString *)string { if (string.length > 1) { // Autofill detected - distribute OTP manually for (int i = 0; i < string.length && i < self.arrayOTPText.count; i++) { UITextField *field = self.arrayOTPText[i]; field.text = [NSString stringWithFormat:@"%c", [string characterAtIndex:i]]; } UITextField *lastField = self.arrayOTPText[string.length - 1]; [lastField becomeFirstResponder]; return NO; } // Handle normal single character or deletion input here return YES; } // // Setup UITextFields - set .oneTimeCode on first field only for (int i = 0; i < self.arrayOTPText.count; i++) { UITextField *field = self.arrayOTPText[i]; field.delegate = self; if (@available(iOS 12.0, *)) { field.textContentType = (i == 0) ? UITextContentTypeOneTimeCode : UITextContentTypeNone; } } What We’ve Tried: Setting textContentType properly. Handling OTP distribution in delegate method. Verifying settings and keyboard use. Testing on multiple iOS 26.x versions. Impact: Major usability degradation during OTP entry. Forces fragile workarounds. Inconsistent autofill reduces user confidence. Request: Request Apple fix OTP autofill to natively support multi-field UITextField OTP input or provide enhanced delegate callbacks for consistent behavior. Did any one face this issue in recent time with iOS 26.0.1 to 26.3 beta version

I'm experiencing a strange issue where ASWebAuthenticationSession works perfectly when running from Xcode (both Debug and Release), but fails on TestFlight builds. The setup: iOS app using ASWebAuthenticationSession for OIDC login (Keycloak) Custom URL scheme callback (myapp://) prefersEphemeralWebBrowserSession = false The issue: When using iOS Keychain autofill (with Face ID/Touch ID or normal iphone pw, that auto-submits the form) -> works perfectly When manually typing credentials and clicking the login button -> fails with white screen When it fails, the form POST from Keycloak back to my server (/signin-oidc) never reaches the server at all. The authentication session just shows a white screen. Reproduced on: Multiple devices (iPhone 15 Pro, etc.) iOS 18.x Xcode 16.x Multiple TestFlight testers confirmed same behavior What I've tried: Clearing Safari cookies/data prefersEphemeralWebBrowserSession = true and false Different SameSite cookie policies on server Verified custom URL scheme is registered and works (testing myapp://test in Safari opens the app) Why custom URL scheme instead of Universal Links: We couldn't get Universal Links to trigger from a js redirect (window.location.href) within ASWebAuthenticationSession. Only custom URL schemes seemed to be intercepted. If there's a way to make Universal Links work in this context, without a manual user-interaction we'd be happy to try. iOS Keychain autofill works The only working path is iOS Keychain autofill that requires iphone-authentication and auto-submits the form. Any manual form submission fails, but only on TestFlight - not Xcode builds. Has anyone encountered this or know a workaround?

Hi everyone, I'm currently working on a native macOS app (built with SwiftUI) and I'm trying to implement Password AutoFill functionality so users can use their saved credentials from Keychain or third-party password managers. I've gone through Apple's documentation, WWDC sessions, and sample code, but I've noticed that the resources primarily focus on iOS and web implementations. There's very limited guidance specifically for macOS. I've set up: Associated Domains entitlement with the webcredentials: service The apple-app-site-association file on my server TextField with .textContentType(.username) and SecureField with .textContentType(.password) However, I'm still not seeing the expected AutoFill behavior on macOS like I would on iOS. Has anyone successfully implemented Password AutoFill on a native macOS app? Are there any macOS-specific considerations or additional steps required that differ from iOS? Any guidance, sample code, or pointers to documentation I might have missed would be greatly appreciated.

I noticed, that even though my AutoFill Credential Provider Extension works with Safari for both Passwords and Passkeys, it doesn't work in context menus inside arbitrary textfields, meanwhile the same is true for the Apple Passwords app. This is a great hit to AutoFill productivity, as my extension is unable to fill textfields by just going to the context menu and clicking AutoFill > Passwords.. Is this a feature only available to Apple via private APIs, or is this something I can interface with? I checked and the Passwords app does use some undocumented but non-private entitlements: [Key] com.apple.authentication-services.access-credential-identities [Value] [Bool] true I also checked the responsible executable for some hints (AutoFillPanelService) however found nothing that would lead me to believe this is a public extension point. Another idea I had was trying to use a macOS Service for this, however Services in the "General" category won't show up in any context menu, only in the Application's Main Menu.

We have encountered a consistent problem with OTP (One Time Password) autofill on iOS versions 26.0.1 through 26.3. The issue pertains to apps implementing OTP input using multiple UITextFields (often 6 or 7 separate text boxes for each digit). Problem Details: When tapping the OTP autofill suggestion from Messages or supported third-party apps, iOS autofill pastes the entire OTP string into just one UITextField (commonly the second or focused field) rather than distributing digits across the individual text fields. The delegated UITextField methods such as textField:shouldChangeCharactersInRange:replacementString: receive an entire OTP string at once, but the usual event handlers like UIControlEventEditingChanged do not always trigger, breaking existing logic relying on those. This results in the OTP input UI showing incorrect or partial OTP, confusing users and forcing manual re-entry. Many popular apps employing multi-field OTP input UIs face similar autofill malfunctions on iOS 26.x, impacting user experience negatively. Setting textContentType = .oneTimeCode on the first text field alone is insufficient to restore the intended autofill behavior on iOS 26.x. This represents a regression or functional deficiency compared to iOS 15-18 autofill handling patterns, which worked reliably for these multi-field OTP UIs.| Expected Behavior: OTP autofill should either automatically split the filled code into each UITextField or trigger consistent delegate/callback events to enable developers to replicate this behavior manually. textDidChange or equivalent events should fire on autofill updates to reflect text changes correctly in multi-field OTP input. Apple’s OTP autofill system should transparently support or provide clear guidelines for handling multi-field OTP input on iOS 26+. What We’ve Tried: Setting .oneTimeCode content type on only the first UITextField. Handling OTP autofill in delegate methods including shouldChangeCharactersInRange. Manual distribution and custom logic triggered by textDidChange and other callbacks. Confirming all relevant system autofill settings are enabled. Testing on multiple devices and iOS versions (26.0.1 through 26.3). Note: its happen for may apps which have text field with 6 box otp fill

Hi Apple, Currently we want to have enhancement for SMS OTP that we want to implement OTP Autofill, But after do some research we're stuck with option that the OTP only show in keyboard suggestion, is there any way for making OTP is automatically filled without user have to click the keyboard suggestion when receiving the SMS. Thanks Best Regards, Admiral Sultano Harly.