# Authorization Services Access restricted areas of the operating system, and control access to particular features of your macOS app. ## Overview The `Security.Authorization` API is a programming interface to the Security Server and its policy database. This API facilitates access control to restricted areas of the operating system and allows you to restrict a user’s access to particular features in your macOS app. Use authorization services in: - Software that restricts access to its own tools - Applications that call system tools - Software installers that install privileged tools or require access to restricted areas of the operating system As shown in the image below, the Security Server is a daemon running in the operating system that provides a trusted implementation of various security protocols, including authorization computation. In turn, the Security Server relies on the Security Agent to interface with users when authentication is needed. Thus an app can verify credentials (usernames and passwords) without ever accessing them directly. This authorization process also allows the means of authentication to change in the future (such as adding Touch ID) without your having to modify your app.  > Note: > For a simplified, class-based version of this API, consider using the class instead. When you need a user interface that enables display and control of the current authorization state for a particular set of rights, use the class. > Important: > The Authorization Services API is not supported within an App Sandbox because the API allows privilege escalation. ## Topics ### Authorization References [`AuthorizationCreate(_:_:_:_:)`](/documentation/Security/AuthorizationCreate(_:_:_:_:)) Creates a new authorization reference and provides an option to authorize or preauthorize rights. [`AuthorizationFree(_:_:)`](/documentation/Security/AuthorizationFree(_:_:)) Frees the memory associated with an authorization reference. [`AuthorizationFlags`](/documentation/Security/AuthorizationFlags) The flags used to specify authorization options. [`AuthorizationRef`](/documentation/Security/AuthorizationRef) A pointer to an opaque authorization reference structure. [`kAuthorizationEmptyEnvironment`](/documentation/Security/kAuthorizationEmptyEnvironment) A constant you use in functions with an environment parameter if you have no environment data to provide. ### Authorization Items Use authorization items (alone or in sets) to represent rights and environment information. [`AuthorizationItem`](/documentation/Security/AuthorizationItem) A structure containing information about an authorization right or the authorization environment. [`AuthorizationItemSet`](/documentation/Security/AuthorizationItemSet) A structure containing a set of authorization items. [`AuthorizationRights`](/documentation/Security/AuthorizationRights) An authorization item set designated to represent a set of rights. [`AuthorizationEnvironment`](/documentation/Security/AuthorizationEnvironment) An authorization item set designated to hold environment information relevant to authorization decisions. [Authorization Name Tags](/documentation/Security/authorization-name-tags) Use name tags to define authorization security items. [`AuthorizationFreeItemSet(_:)`](/documentation/Security/AuthorizationFreeItemSet(_:)) Frees the memory associated with a set of authorization items. ### Rights and Credentials [`AuthorizationCopyInfo(_:_:_:)`](/documentation/Security/AuthorizationCopyInfo(_:_:_:)) Retrieves supporting data such as the user name and other information gathered during evaluation of authorization. [`AuthorizationCopyRights(_:_:_:_:_:)`](/documentation/Security/AuthorizationCopyRights(_:_:_:_:_:)) Authorizes and preauthorizes rights synchronously. [`AuthorizationCopyRightsAsync(_:_:_:_:_:)`](/documentation/Security/AuthorizationCopyRightsAsync(_:_:_:_:_:)) Authorizes and preauthorizes rights asynchronously. [`AuthorizationAsyncCallback`](/documentation/Security/AuthorizationAsyncCallback) A block used as a callback for the asynchronous version of copying authorization rights. [`AuthorizationString`](/documentation/Security/AuthorizationString) A zero-terminated string in UTF-8 encoding. [Authorization Rights Flags](/documentation/Security/authorization-rights-flags) Recognize the values the Security Server sets in an authorization item’s flag field. ### Import and Export [`AuthorizationMakeExternalForm(_:_:)`](/documentation/Security/AuthorizationMakeExternalForm(_:_:)) Creates an external representation of an authorization reference. [`AuthorizationCreateFromExternalForm(_:_:)`](/documentation/Security/AuthorizationCreateFromExternalForm(_:_:)) Internalizes the external representation of an authorization reference. [`AuthorizationExternalForm`](/documentation/Security/AuthorizationExternalForm) The external representation of an authorization reference. [`kAuthorizationExternalFormLength`](/documentation/Security/kAuthorizationExternalFormLength) The number of bytes in an external form structure’s array. ### The Policy Database [`AuthorizationRightGet(_:_:)`](/documentation/Security/AuthorizationRightGet(_:_:)) Retrieves a right definition as a dictionary. [`AuthorizationRightSet(_:_:_:_:_:_:)`](/documentation/Security/AuthorizationRightSet(_:_:_:_:_:_:)) Creates or updates a right entry in the policy database. [`AuthorizationRightRemove(_:_:)`](/documentation/Security/AuthorizationRightRemove(_:_:)) Removes a right from the policy database. [Policy Database Constants](/documentation/Security/policy-database-constants) Use these constants to set rights and rules in the policy database. ### Executing with Root Privileges [`AuthorizationExecuteWithPrivileges`](/documentation/Security/AuthorizationExecuteWithPrivileges) Runs an executable tool with root privileges. [`AuthorizationCopyPrivilegedReference`](/documentation/Security/AuthorizationCopyPrivilegedReference) Retrieves the authorization reference passed by the AuthorizationExecuteWithPrivileges function. ### Result Codes [Authorization Services Result Codes](/documentation/Security/authorization-services-result-codes) Recognize result codes specific to the authorization services API. ## See Also [Authentication, Authorization, and Permissions Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40011200) [Authorization Services Programming Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/authorization_concepts/01introduction/introduction.html#//apple_ref/doc/uid/TP30000995) --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)