Hello, I've developed a macOS app with an AutoFill Credential Provider extension that functions as a passkey provider. In the registration flow, I want my app to appear as a passkey provider only when specific conditions are met. Is there a way to inspect the request from the web before the passkey provider selection list is displayed to the user, determine whether my app can handle it, and then use that result to instruct the OS on whether to include my app in the passkey provider selection list? Alternatively, is there a way to predefine conditions that must be met before my app is offered as a passkey provider in the selection list? Thanks!

I want to implement webauthn using WKWebView for my mac application. I want to host the asaa file in the rpid. Below are my site configuration - Main domain - example.com Subdomain which has the sign-in view and where webauthn kicks in - signin.example.com RPID - example.com Where shall i host the asaa file at domain(example.com) or subdomain(signin.example.com)?

When WKWebView loads a site that has username and password on different pages, standard "Passwords" button above keyboard does nothing. Reproducible on both physical device and simulator. At the same time, Safari works fine in this case. Any chance to fix this behavior in the upcoming iOS updates? Here's video demonstrating the issue: and a sample code to reproduce it (nothing specific, just bare WKWebView with default configuration): class ViewController: UIViewController { private let webView = WKWebView(frame: .zero) override func viewDidLoad() { super.viewDidLoad() view.addSubview(webView) } override func viewDidLayoutSubviews() { super.viewDidLayoutSubviews() webView.frame = view.bounds } override func viewDidAppear(_ animated: Bool) { super.viewDidAppear(animated) webView.load(URLRequest( url: URL(string: "https://accounts.google.com/")! )) } }

On Mac, If the user registers the Password and the Software Authenticator app for a website like PayPal then uses the Safari browser to login the Apple system is creating confusion. The system prompts to use the authenticator autofill for any grid like SMS OTP or even for the Email OTP. That creates confusion for the user as the SMS OTPs or other OTPs cannot be validated by auto filling the Authenticator TOTP. That fails the validation resulting in bad user experience. The system should not prompt the Autofill from the Authenticator app unless the grid box shown on the page was for the Authenticator app.

I am working on task to add WKWebView to Autofill extension. This web view presents web content that can access camera feed. As an example here is a simple html: I have added Camera permission entitlements to both main app and autofill extension Info.plist Camera feed is accessed properly from the main app. However, doing the same in the Autofill extension does not show Camera stream in the web content. I am receiving camera permissions alert and am allowing permissions. It just stucks on the black screen and in console I see these logs: 16000a00 - GPUProcessProxy::didClose: 0x116000a00 - GPUProcessProxy::gpuProcessExited: reason=Crash 0x1150180c0 - [PID=1 523] WebProcessProxy::gpuProcessExited: reason=Crash Error acquiring assertion: <Error Domain=RBSServiceErrorDomain Code=1 "target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit" UserInfo={NSLocalizedFailureReason=target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit}> 0x115020360 - ProcessAssertion::acquireSync Failed to acquire RBS assertion 'GPUProcess Background Assertion' for process with PID=1 524, error: Error Domain=RBSServiceErrorDomain Code=1 "target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit" UserInfo={NSLocalizedFailureReason=target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit} 0x1160012a0 - GPUProcessProxy::didClose: 0x1160012a0 - GPUProcessProxy::gpuProcessExited: reason=Crash 0x1150180c0 - [PID=1 523] WebProcessProxy::gpuProcessExited: reason=Crash Error acquiring assertion: <Error Domain=RBSServiceErrorDomain Code=1 "target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit" UserInfo={NSLocalizedFailureReason=target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit}> 0x115020300 - ProcessAssertion::acquireSync Failed to acquire RBS assertion 'GPUProcess Background Assertion' for process with PID=1 525, error: Error Domain=RBSServiceErrorDomain Code=1 "target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit" UserInfo={NSLocalizedFailureReason=target is not running or doesn't have entitlement com.apple.runningboard.assertions.webkit} Looks like WKWebView crashes. Here are my configurations for the WKWebView: let webConfiguration = WKWebViewConfiguration() webConfiguration.allowsInlineMediaPlayback = true webConfiguration.mediaTypesRequiringUserActionForPlayback = [] let webView = WKWebView(frame: .zero, configuration: webConfiguration) webView.navigationDelegate = self webView.uiDelegate = self webView.scrollView.isScrollEnabled = false webView.contentMode = .scaleAspectFit view.addSubview(webView) Does anyone know what might be the problem? Is it even possible to access Camera from web content in Autofill extension?

Through focussed debugging, I have discerned that if a web page's "text" input element's name attribute contains a dash (and does not contain -#- (e.g. -0-)), Safari will: Display a contacts icon inside the field and Add a drop-down populated with phone numbers from the user's contact card (on top of any pre-existing datalist dropdown). Ignore the element's autocomplete="off" There is post after post and blog article after blog article on the web that propose endless solutions to similar Safari issues, each working in various different contexts. It's a mess really. I am currently trying to develop a django web form for scientific data using django's FormSet class. Specifically, I was using FormsSet.empty_form to create a javascript clone-able form that would propagate field values to added (numbered) forms. I implemented things incrementally. I started out with a regular form and encountered a behavior where an autofill dropdown would present me with previously submitted values, e.g.: Adding autocomplete="off" to the input element prevented this. I then implemented formsets, defaulting to 1 form (so that all input elements' names started with form-0-) and everything worked as expected. However, when I changed the strategy with default to 0 initial forms and presented FormSet.empty_form as a template that would be cloned anytime files were dropped/selected, I started getting phone number drop-downs in all of the test fields: I googled this quite a bit and tried many things, including a strategy I'd employed before, to no avail, so to make debugging this issue easier and try a bunch of things quickly, I saved the page source and put it in the static folder, then started tweaking things to figure out what was causing this to happen. It appears that anytime a text input element's name attribute contains a dash (and does not contain -#-), Safari assumes it's a phone number field, despite the fact that the name's text, placeholder's text, possibly the label's text, the fact that the element has a list attribute set to the ID of a datalist element, and the fact that autocomplete is explicitly set to off. I would say that the heuristic used to trigger phone number autofill needs some serious tweaking. Not only that, but web developers need more transparency on how it works, so that non-sensical autofill behavior like this can be avoided. Another aspect of this is that if you have lots of cloned forms that Safari tries to apply autofill to, it dramatically decreases the page's performance. Safari autofill behavior has been a constant bane of mine, because many of our users use macs. I have not yet tried CSS solutions I've seen hints of (mainly because all the articles/posts I've seen about them are quite dated). Any information anyone can provide to tame Safari autofill and prevent this errant behavior would be much appreciated.

How can I trigger, or rather, when is the ASCredentialProviderViewController.prepareOneTimeCodeCredentialList(for:) method triggered? I can't seem to get it to work. I've added the ProvidesOneTimeCodes key to the Info.plist. I've added the com.apple.developer.authentication-services.autofill-credential-provider entitlement. Example of the extension: class CredentialProviderViewController: ASCredentialProviderViewController { override func prepareOneTimeCodeCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier]) { print("********************************* prepareOneTimeCodeCredentialList \(serviceIdentifiers)") } override func prepareInterfaceForUserChoosingTextToInsert() { print("********************************* prepareInterfaceForUserChoosingTextToInsert") } } The app is enabled in the AUTOFILL FROM: in Settings App.

Topic description: when a user wants to create a new Account and ignores the "Use strong password" or "choose other option" and clicks on button to next screen, the app will hang. User Interaction / Experience A Screen with usernameInputField, a passwordInputField and a Button to create the account. The next screen will be pushed (not modally). The second screen allows some userinteraction (in the example counting upwards and displaying this, which allows checking if the app responds to input). How to reproduce The user types in a username and klicks on the passwordTextField. A strong password is suggested by Apple. The overlay shows at the bottom. We ignore the Buttons provided by the overlay and press on the button in the app to create the account. Transition to next page animates, but the next screen is unresponsive. Expected behavior (which works sometimes, when running with debugger) On the second screen the Do you want to store the password action sheet should be displayed (like in the screenshot). Findings This bug occures for our production App with UIKit and SwiftUI implementation. I could also find an App on the AppStore with the same Bug and similar patterns (usernameField + passwordField + nextButton + navigation by pushing the next viewController). I implemented the most basic to reproduce the bug and be sure it is nothing in my code. I cannot provide a standalone project, because https://&lt;fully qualified domain&gt;/.well-known/apple-app-site-association Information needs to be given for strong password to be suggested. Screenshots when not running into bug. // AppDelegate func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -&gt; Bool { appWindow = UIWindow(frame: UIScreen.main.bounds) let viewController = UIHostingController(rootView: ContentView()) let navigationController = UINavigationController(rootViewController: viewController) appWindow.rootViewController = navigationController appWindow.makeKeyAndVisible() return true } // Create Account implementation struct CounterView: View { @State var counter = 0 var body: some View { VStack { Text(String(counter)) .font(.title) Button("+", action: { counter += 1 }) .buttonStyle(BorderedProminentButtonStyle()) } } } struct ContentView: View { @State var username = "" @State var password = "" var body: some View { VStack { Text("Choose your login credentials") .padding() TextField("username", text: $username) .textContentType(.username) SecureField("password", text: $password) .textContentType(.newPassword) NavigationLink(destination: CounterView()) { Text("create account") } } .padding(40) } } The bug does NOT occure when you have the debugger attached from the start. I was able to get the bug and then attach to the process. I could see that memory raised drastically and the app crashed after a long time. While testing, I could see once View &lt;:0x0&gt; does not conform to UITextInput protocol being printed to the console. The bug does not occure when you present the next screen modally. With Debugger attached the App response as expected and presents the action sheet for do you want to store the password. My guess I think when the transition to the next screen happens, the reference to some critical information for save password gets deallocated and then some Apple Api tries to show the action sheet but this does not work because some Information is missing. This seems to prevent the userinteraction and some code runs in an endless loop which would explain the memory raising quickly (our production build runs normally between 30 MB and 80 MB Memory). Does anyone have similar issues? I think all Ideas to fix this are some sort of hacks to make it work and I would think Apple needs to fix this, what do you think?

"ASCredentialProviderViewController" class was implemented in my password manager to autofill password for the app clients. I've added passkey support recently but biometric/code authentication is not asked by the system when the user tries to sign in with a passkey thanks to "provideCredentialWithoutUserInteraction(for credentialRequest: ASCredentialRequest)". For passwords: extensionContext.completeRequest(withSelectedCredential: ASPasswordCredential(), completionHandler: nil) -> Does trigger biometric/code authentication For passkeys: extensionContext.completeAssertionRequest(using: ASPasskeyAssertionCredential()) -> Does NOT trigger biometric/code authentication => Why authentication is managed by the system for password but not for passkeys ? And how to fix that?

I recently released my first app. I noticed that on my login screen, the keyboard on both my email TextField and my password SecureField was showing an autofill for passwords. I was setting their keyboard type, but looking into this, I noticed that there is a text content type that I should also be setting. Upon setting this, nothing changed. The only thing that does seem to change this functionality is by hiding the SecureField. I ran into a problem when I tried adding a dismiss button to the toolbar of these keyboards. I was able to find people talking about this being an iOS 17 bug. However, I have not found anyone talking about this autofill issue. Is this also a bug in iOS 17? Back when I was creating the login page for my app, I believe it was still iOS 16, and that would explain why I didn't notice it before. One more note I just ran across while testing. If I add a second identical TextField, it won't have this autofill.

I did implement "ASCredentialProviderViewController" class for my password manager in order to support passkey recently. Passkey registration and assertion works correctly but remote fullfilling is not working as expected. Use case: The user wants to sign in with passkey on some computer A QRCode is displayed and the user scan the QRCode Apple Authentication bottom sheet is opened and the client can pick my app as a provider ISSUE HERE: my app doesn't receive the passkey request parameters and is not able to generate the assertion answer I was hoping the following functions to be called but it's not the case: prepareCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier], requestParameters: ASPasskeyCredentialRequestParameters) prepareInterfaceToProvideCredential(for credentialRequest: ASCredentialRequest) provideCredentialWithoutUserInteraction(for credentialRequest: ASCredentialRequest) => Please, how can my app receive the passkey request parameters in order to generate the assertion answer in this situation?

It is clearly stated here that automatically created passwords are 20 characters long, contain 2 hyphens and exactly one uppercase letter and one digit. I have only ever seen generated passwords where the arrangement is in 3 groups of 6 (separated by the hyphens). From the description in the page referred to above, it could be that the generated password might look like: nzomZhf-qnbqd-k8ibtt i.e., a 7-5-6 pattern This would comply with the definition (if that's what it is) on the aforementioned Support page. Is it guaranteed that auto generated passwords will conform to the 3 groups of 6 pattern?

Hello forums, I have a problem with Autofill multiply SecureFields. I created a SwiftUI view with 2 SecureFields, createPassword and confirmPassword. Does not matter how I change the textContentType, AutoFill will only fill the first SecureField. For testing, I set the first SecureField textContentType to .none / .userName/ .email, and second SecureField sets to .newPassword, but AutoFill still fills password in first SecureField. As I know Apple advises to put both SecureField textContentType to .newPassword but it seems only working in UIKit: Enabling Password AutoFill on a text input view struct ContentView: View { @State private var createPassword = "" @State private var confirmPassword = "" var body: some View { VStack { SecureField("Password", text: $createPassword) .textContentType(.newPassword) SecureField("Password confirmation", text: $confirmPassword) .textContentType(.newPassword) } .padding() } } Thank you!

I want to add my testing app and prod app for release in associated domain file. How can I add them in apple-app-site-association. Can I add both separated by coma { "webcredentials": { "apps": [ "3ABCDEF.com.lalitha.release" , 3ABCDEF.com.lalitha.test] } } In Apple documentation example they haven't mention about adding multiple apps under web credentials [https://developer.apple.com/documentation/xcode/supporting-associated-domains]

I've setup applinks for Universal Links purposes on my app. But I noticed that setting up applinks also sets up Password AutoFill. Upon logging in I don't want my users to be prompted to Save Password because of the way we use our subdomains. How can I disable Password AutoFill while retaining Universal Links capability, and without disabling secureTextEntry on my UITextField?

We are implementing a 3rd party Passkeys Manager app for ios. In the ios app in the CredentialProviderViewController I've implemented: func prepareCredentialList( for serviceIdentifiers: [ASCredentialServiceIdentifier] ) func provideCredentialWithoutUserInteraction( for credentialRequest: ASCredentialRequest ) func prepareInterfaceToProvideCredential( for credentialRequest: ASCredentialRequest ) func prepareInterface( forPasskeyRegistration registrationRequest: ASCredentialRequest ) When testing on webpages like webauthn.io and webauthn.me , our app shows up as one of the options for creating a passkey. We are getting the calls in prepareInterface() and handling it as advised here https://developer.apple.com/documentation/authenticationservices/ascredentialproviderviewcontroller/4172626-prepareinterface/ However the registration is failing. I understand that in this function, we need to create a passkey using a crypto library and then call completeRegistrationRequest(using:completionHandler:) The documentation on this is scant so it is hard to debug for this reason. Need help fixing this issue. What could we be missing? Is there any sample code for overriding these functions? Any recommendations on the crypto library for generating passkeys When the passkeys have been generated, how do we pass it back to the system? Thank you, Jaydip.

Hello everyone, I am encountering an issue with the iOS Autofill framework where the app saves the password with only the main domain (company.com) instead of the full subdomain (xyz.company.com) that I have specified. Here are the details of my configuration: Entitlements.plist: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.associated-domains</key> <array> <string>applinks:xyz.company.com</string> <string>webcredentials:xyz.company.com</string> </array> <key>keychain-access-groups</key> <array> <string>$(AppIdentifierPrefix)com.company</string> </array> </dict> </plist> apple-app-site-association file: { "applinks": { "details": [ { "appIDs": ["ABCDEFGHIJ.com.company"] } ] }, "webcredentials": { "apps": ["ABCDEFGHIJ.com.company"] } } Issue Description: I have configured the Entitlements.plist and the apple-app-site-association file to use a subdomain (xyz.company.com). However, when the app saves the password, it only saves it under company.com rather than the full subdomain xyz.company.com. Steps Taken: Verified that the Entitlements.plist contains the correct entries for applinks and webcredentials. Checked the apple-app-site-association file to ensure it includes the correct app IDs and details. Confirmed that the subdomain xyz.company.com is correctly set up and accessible. Expected Behavior: The Autofill framework should save passwords with the full subdomain xyz.company.com as specified in the configuration. Actual Behavior: Passwords are being saved with only the main domain company.com, ignoring the specified subdomain. Questions: Is there a specific configuration or step that I might be missing to ensure that the Autofill framework recognizes the full subdomain? Are there any known issues or limitations with using subdomains in the applinks and webcredentials settings? Any insights or suggestions on how to resolve this issue would be greatly appreciated. Thank you in advance for your help! Best regards, Andy

Hello everyone! In our application, we have login via phone number (with an SMS code as a password) and the ability to add a bank card to Apple Wallet. When logging in via phone number, upon receiving the SMS code, it automatically suggests filling in the input field. However, the field itself is not of type .oneTimePassword, and the SMS does not contain @domain, #code at the end (please look at the screenshot). So, when adding a card to Apple Wallet, PKAddPaymentPassViewController is launched, where entering the code from the SMS is also required to activate the card. However, no autocomplete prompt for the SMS password appears when displaying this field. Does anyone have information on why this is happening and how it can be implemented?

I am developing a Mac app which provides a Credential Provider extension and I'm having trouble with passkey integration. I wrote here about the issue I'm having with the iOS app. On the Mac I'm experiencing a different issue. As opposed to the iOS app (where I'm not even able to use my extension to create a new passkey in the first place) on the Mac I'm able to use my extension to create a passkey. I save the credential identity into the system AutoFill suggestions store without error. The problem is that when I attempt to authenticate on the same site the system does not offer my app's credential as a suggestion. Standard passwords are working fine. Can anyone help me understand how I can troubleshoot this type of problem? Thanks! -Jeremy

Any extension views called from ASCredentialProviderViewController -> open func prepareInterface(forPasskeyRegistration registrationRequest: ASCredentialRequest) cannot be accessed through Keyboard (Setting->Accessibility->Keyboards->Full Keyboard Access enabled). I have to manually type the prompted screen once to be able to get focused and continue to use Keyboard. Is it a known issue or I am missing anything? Please suggest. Thanks!