<!--
{
  "availability" : [
    "iOS: 16.0.0 -",
    "iPadOS: 16.0.0 -",
    "macCatalyst: 16.0.0 -",
    "macOS: 13.0.0 -",
    "visionOS: 1.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "LocalAuthentication",
  "identifier" : "/documentation/LocalAuthentication/LARightStore",
  "metadataVersion" : "0.1.0",
  "role" : "Class",
  "symbol" : {
    "kind" : "Class",
    "modules" : [
      "Local Authentication"
    ],
    "preciseIdentifier" : "c:objc(cs)LARightStore"
  },
  "title" : "LARightStore"
}
-->

# LARightStore

A container for data protected by a right.

```
class LARightStore
```

## Overview

Use an [`LARightStore`](/documentation/LocalAuthentication/LARightStore) along with an [`LARight`](/documentation/LocalAuthentication/LARight) to make secrets accessible only after certain conditions, including authentication, are met. Storing secrets this way lets you tie the availability of sensitive resources to the authorization status of the user.

The following stores a named access token behind the default authorization requirements:

```swift
func storeBackendAccessToken(_ token: Data) async throws {
    let loginRight = LARight()
    _ = try await LARightStore.shared.saveRight(loginRight, identifier: "access-token", secret: token)
}
```

The system stores your secret in the keychain and protects it with a unique key in the Secure Enclave. The system associates the key with your right and with an access control list that ensures that the data is only accessible after your access requirements are met.

You can retrieve stored secrets later using the right’s identifier:

```swift
func fetchBackendAccessToken() async throws -> Data {
    let loginRight = try await LARightStore.shared.right(forIdentifier: "access-token")

    // Authorize the right or else the secret is unavailable.
    try await loginRight.authorize(localizedReason: "Access sandcastle competition server")
    return try await loginRight.secret.rawData
}
```

## Topics

### Accessing rights

[`shared`](/documentation/LocalAuthentication/LARightStore/shared)

A shared object that stores rights.

[`right(forIdentifier:completion:)`](/documentation/LocalAuthentication/LARightStore/right(forIdentifier:completion:))

Fetches a previously stored right from the shared right store.

### Storing rights

[`saveRight(_:identifier:completion:)`](/documentation/LocalAuthentication/LARightStore/saveRight(_:identifier:completion:))

Saves a right to a persistent right store.

[`saveRight(_:identifier:secret:completion:)`](/documentation/LocalAuthentication/LARightStore/saveRight(_:identifier:secret:completion:))

Saves a right to a persistent store along with secret data you supply.

### Removing stored rights

[`removeRight(_:completion:)`](/documentation/LocalAuthentication/LARightStore/removeRight(_:completion:))

Removes a right from the right store given an instance of that right.

[`removeRight(forIdentifier:completion:)`](/documentation/LocalAuthentication/LARightStore/removeRight(forIdentifier:completion:))

Removes a right from the right store given its unique identifier.

[`removeAllRights(completion:)`](/documentation/LocalAuthentication/LARightStore/removeAllRights(completion:))

Removes all rights associated with this client from the right store.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)