Apple Safari Authentication

generated: '2026-09-07'
method: searched
source: >-
  https://developer.apple.com/documentation/usernotifications/sending-web-push-notifications-in-web-apps-and-browsers,
  https://developer.apple.com/documentation/applepayontheweb/requesting-an-apple-pay-payment-session,
  https://developer.apple.com/documentation/applepayontheweb/setting-up-your-server,
  https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession
specification: API Commons Authentication
specificationVersion: '0.1'
provider: Apple Safari
providerId: apple-safari
description: >-
  There is no single Safari API credential. Authentication is per-surface, and two of the
  three network surfaces use certificate- or key-based schemes rather than a bearer token
  or API key — which is why no OAuth or OpenID discovery document is served on any host
  in this record. Derived by reading the docs, not from an OpenAPI securitySchemes block:
  Apple publishes no OpenAPI for Safari.
schemes:
  - id: vapid-jwt
    surface: Apple Web Push service
    type: http
    scheme: vapid
    location: Authorization header
    description: >-
      The application server signs a VAPID JSON Web Token with its own private key and
      sends it, together with the matching VAPID public key, in the Authorization header.
      The public key must match the one passed to PushManager.subscribe for that
      subscription.
    constraints:
      - JWT subject claim must be a URL or a mailto: URI.
      - JWT audience claim must be the origin of the push service the request is sent to.
      - JWT expiration must not be more than one day in the future.
      - Do not refresh the JWT more frequently than once per hour.
    failure_modes:
      - BadAuthorizationHeader
      - BadJwtToken
      - BadVapidPublicKey
      - VapidPkHashMismatch
    docs: https://developer.apple.com/documentation/usernotifications/sending-web-push-notifications-in-web-apps-and-browsers
    requires_paid_membership: false
  - id: apple-pay-mtls
    surface: Apple Pay merchant validation
    type: mutualTLS
    location: TLS client certificate
    description: >-
      "Your server posts a request using mutual TLS (mTLS)" to the Apple Pay Payment
      Session endpoint, presenting the merchant identity certificate associated with the
      merchant ID. The request must come from the server, never from the client.
    constraints:
      - TLS 1.2 or later.
      - 'Cipher suite limited to: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384.'
      - TLS Server Name Indication (SNI) required on all connections.
      - HTTPS over TCP port 443 to a strict allow list of Apple Pay gateway domains and IP ranges.
      - The returned session object expires after five minutes.
    docs: https://developer.apple.com/documentation/applepayontheweb/requesting-an-apple-pay-payment-session
    requires_paid_membership: true
    membership_note: The merchant identity certificate is issued through an Apple Developer Program account.
  - id: safaridriver-local
    surface: safaridriver (W3C WebDriver + Safari MCP server)
    type: none
    location: local machine
    description: >-
      No credential. Access is authorised by the user turning on "Allow remote automation
      and external agents" in Safari's Developer settings on their own machine, and the
      driver is reachable only from that machine. Automation sessions run in isolated
      windows that cannot read browsing history, AutoFill data or other sensitive state.
    docs: https://developer.apple.com/documentation/webkit/about-webdriver-for-safari
    requires_paid_membership: false
  - id: aswebauthenticationsession
    surface: Safari Authentication Services API
    type: delegated
    description: >-
      ASWebAuthenticationSession is the client-side handoff an app uses to run an OAuth or
      WebAuthn flow in Safari and receive the callback. Safari is the user agent in the
      flow — it is not itself an authorization server, and it issues no tokens of its own.
      Passkeys/WebAuthn credentials are held by the platform and the relying party is the
      site, not Apple.
    docs: https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession
    requires_paid_membership: false
no_credential_required:
  apis:
    - Safari Extensions API
    - Safari App Extensions API
    - Safari Web Content API (WebKit)
    - Safari Services API
    - Safari Content Blocking API
    - Safari Developer Tools API
  note: >-
    In-process platform APIs. Distribution through App Store Connect requires Apple
    Developer Program membership, but calling the API does not.
discovery_documents:
  openid_configuration: not served
  oauth_authorization_server: not served
  evidence: well-known/apple-safari-well-known.yml
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com
    url: https://apievangelist.com