17.12 · Passkey assertions, Apple ID tokens and Live Activity payloads

Sign-in and live updates are server-verified protocols; the app only carries the bytes.

Mental model. The server must check challenge, origin, flags, signature and counter for passkeys, and issuer, audience, expiry and nonce for Apple tokens.

Verifying identity

What a relying party checks.

  1. What must a server verify when it receives a passkey assertion? 17.12.1 · L8
    The authenticator returns authenticatorData (32-byte hash of the relying-party id, a flags byte, a 4-byte big-endian signature counter), clientDataJSON (type…
  2. How do you validate a Sign in with Apple identity token on a server, and what is the nonce for? 17.12.2 · L5
    The identity token is a JWT. The server verifies the signature with Apple’s public keys (published at the keys endpoint, chosen by kid, RS256) and then the…

Live Activities

The size and shape of updates.

  1. How big can a Live Activity update be, and what do update and end pushes look like? 17.12.3 · L5
    A Live Activity’s dynamic data is the ContentState, a small Codable struct (46 JSON characters in the run), and an update push carries it under aps as…

More in System frameworks