<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/authorization-plug-ins",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Authorization Plug-ins"
}
-->

# Authorization Plug-ins

Extend the authorization services API by creating plug-ins that can participate in authorization decisions.

## Overview

Use plug-ins to extend macOS authorization services to perform authorizations in a new way or to implement a new policy that is too complex to be implemented entirely with the authorization policy database.

You must import this API explicitly:

```swift
import Security.AuthorizationPlugin
```

> Note:
> When your plug-in needs to interact with the user, subclass the <doc://com.apple.documentation/documentation/SecurityInterface/SFAuthorizationPluginView> class to maintain the look and feel of the system authentication dialogs.

## Topics

### First Steps

[Extending authorization services with plug-ins](/documentation/Security/extending-authorization-services-with-plug-ins)

Modify the system’s authorization policy with custom code.

### Creating a Plug-in

[`AuthorizationPluginCreate`](/documentation/Security/AuthorizationPluginCreate)

Initializes the plug-in and exchanges interfaces with the authorization engine.

[`AuthorizationPluginRef`](/documentation/Security/AuthorizationPluginRef)

A handle passed by the plug-in to the authorization engine when the plug-in is initiated.

[`AuthorizationCallbacks`](/documentation/Security/AuthorizationCallbacks)

The interface implemented by the Security Server.

[AuthorizationCallbacks Version](/documentation/Security/AuthorizationCallbacks-version)

The version of the interface implemented by the authorization engine.

[`AuthorizationPluginInterface`](/documentation/Security/AuthorizationPluginInterface)

The interface that must be implemented by your plug-in.

[AuthorizationPluginInterface Version](/documentation/Security/AuthorizationPluginInterface-version)

The version of the interface implemented by the plug-in.

### Supporting Types and Constants

[`AuthorizationValue`](/documentation/Security/AuthorizationValue)

A structure used to pass data between the authorization engine and the plug-in mechanism.

[`AuthorizationValueVector`](/documentation/Security/AuthorizationValueVector)

A structure used to pass arguments from the authorization policy database to the authorization mechanism.

[`AuthorizationMechanismId`](/documentation/Security/AuthorizationMechanismId)

The mechanism ID specified in the authorization policy database is passed to the plug-in to create the appropriate mechanism.

[`AuthorizationPluginId`](/documentation/Security/AuthorizationPluginId)

An unused identifier for a plug-in.

[`AuthorizationMechanismRef`](/documentation/Security/AuthorizationMechanismRef)

A handle passed by the plug-in to the authorization engine when creating an instance of a mechanism.

[`AuthorizationEngineRef`](/documentation/Security/AuthorizationEngineRef)

Handle passed from the authorization engine to an instance of a mechanism in a plug-in.

[`AuthorizationSessionId`](/documentation/Security/AuthorizationSessionId)

A unique value for an authorization session, provided by the authorization engine.

[`AuthorizationResult`](/documentation/Security/AuthorizationResult)

The permissible values for an authorization evaluation result.

[`AuthorizationContextFlags`](/documentation/Security/AuthorizationContextFlags)

The flags that specify whether authentication data should be made available to the authorization client.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)