Swift sessions and access - Polygon Developer Docs

An active session combines a selected wallet with an unexpired OMS credential. The SDK persists completed session metadata and restores it when you create OMSWallet again.

Read restored session state

let omsWallet = try OMSWallet(publishableKey: "YOUR_PUBLISHABLE_KEY")
let session = omsWallet.wallet.session

if let walletAddress = session.walletAddress {
    print("Restored wallet:", walletAddress)
    print("Expires:", session.expiresAt as Any)
    print("Identity:", session.auth?.email as Any)
}

OMSWalletSessionState contains completed-session metadata: walletAddress, expiresAt, and authentication metadata in auth. For OIDC, the metadata identifies .idToken or .redirect, the issuer, optional provider details, and an email when OMS returns one. The request-signing credential is separate. Its non-extractable P-256 private key remains Keychain-managed and is not serialized into OMSWalletSessionState. Restoration succeeds only when the completed metadata is unexpired and its Keychain credential can be restored.

A manual PendingWalletSelection is not completed session metadata. It remains in memory only until your app activates a wallet.

Observe expiration

Expired sessions are not activated. Keep the returned observation alive while you need notifications. The callback runs on MainActor.

let expiryObservation = omsWallet.wallet.addSessionExpiredObserver { event in
    print("Expired wallet:", event.session.walletAddress ?? "unknown")
    print("Expired at:", event.expiredAt)
}

// Cancel when the owner no longer needs notifications.
expiryObservation.cancel()

The event retains the expired session snapshot so you can choose the appropriate reauthentication UI.

List, switch, and create wallets

These operations require the authenticated credential. listWallets() follows all server cursors and returns the complete list.

let wallets = try await omsWallet.wallet.listWallets()

if let secondary = wallets.dropFirst().first {
    let selected = try await omsWallet.wallet.useWallet(
        walletId: secondary.id
    )
    print("Selected:", selected.walletAddress)
}

Create and activate another wallet for the same credential when your product requires one.

let created = try await omsWallet.wallet.createWallet(
    reference: "trading"
)

print("Created:", created.wallet.address)

Both useWallet and createWallet replace the active wallet while preserving the current session expiry and authentication metadata. Pass walletType: .solana to create a Solana wallet:

let solana = try await omsWallet.wallet.createWallet(
    walletType: .solana,
    reference: "solana-primary"
)

Import and activate a wallet

let imported = try await omsWallet.wallet.importWallet(
    privateKey: .ethereum("0x..."), // Supply the key from your secure migration flow.
    reference: "imported-wallet"
)

print(imported.wallet.keyOrigin == .imported)

Ethereum imports accept 32 raw bytes or 64 hexadecimal digits with an optional 0x prefix. Solana imports accept a 32-byte seed or 64-byte keypair as raw bytes, or the base58 encoding of either. The SDK encrypts the key locally for the attested import transport and does not persist the plaintext key. The current WaaS key origins are .enclave and .imported; Swift preserves an unrecognized future value as .unknown(String). Attestation failures throw OMSWalletError with code .attestationVerificationFailed.

Development uses Nitro debug-mode attestation. Use only disposable test keys in Development. Staging and Production verify against SDK-pinned enclave measurements.

Understand access objects

Keep these three objects distinct:

Object	Purpose
Wallet session	Local active-wallet state used by protected SDK operations.
Wallet ID token	Short-lived token returned by OMS for your backend to verify the active wallet.
Access grant	A direct `WalletCredential` or remote smart session that can make signed requests for the wallet until it expires or is revoked.

The OIDC provider ID token used during authentication is a fourth object: it is app-owned identity proof consumed as auth input, not an OMS wallet token.

Request a wallet ID token

Call getIdToken() only after a wallet is active. Send the returned string to a backend that verifies it using the OMS issuer and JWKS flow described in backend wallet verification.

let walletIdToken = try await omsWallet.wallet.getIdToken(
    ttlSeconds: 3_600,
    customClaims: [
        "role": .string("member")
    ]
)

Custom claims originate in the client. Your backend should not treat them as trusted authorization state unless it controls how they are assigned.

List and revoke access grants

Use listAccess() to load all access-grant pages for account-management UI.

let grants = try await omsWallet.wallet.listAccess()

for grant in grants {
    switch grant {
    case .direct(let credential):
        print(credential.credentialId, credential.isCaller)
    case .remote(let remote):
        print(remote.credential.credentialId, remote.sessionId)
        print(remote.metadata, remote.grants)
    }
}

Use the async sequence when your UI should process one server page at a time.

for try await page in omsWallet.wallet.listAccessPages(pageSize: 25) {
    for grant in page.grants {
        print(grant.credential.credentialId, grant.credential.isCaller)
    }
}

You can also request one page with listAccessPage(pageSize:cursor:type:). Revoke only a grant whose credential has isCaller == false:

if let grant = grants.first(where: { !$0.credential.isCaller }) {
    switch grant {
    case .direct(let credential):
        try await omsWallet.wallet.revokeAccess(
            credentialId: credential.credentialId
        )
    case .remote(let remote):
        try await omsWallet.wallet.revokeAccess(
            credentialId: remote.credential.credentialId,
            sessionId: remote.sessionId
        )
    }
}

For a remote grant, sessionId is required and revokes exactly that session. Revocation cannot be undone. Revoking the caller invalidates the credential making the current request and prevents subsequent protected operations from that session. Keep caller revocation out of the normal access-management UI.

Authorize remote access

Remote access grants are bounded EVM smart sessions. Inspect the remote credential and show its returned metadata to the wallet owner before requesting approval: This example uses Polygon Amoy. Grant limits are raw EVM base-unit amounts. A native-transfer limit is cumulative, so 1000000000000000 wei authorizes up to 0.001 POL across the session.

import Foundation

let credentialId = "REMOTE_CREDENTIAL_ID"
let metadata = try await omsWallet.wallet.inspectRemoteCredential(
    credentialId: credentialId
)

// Render the returned metadata in your consent UI and continue only after approval.
print(metadata.appName, metadata.appUrl)

let session = try await omsWallet.wallet.authorizeRemoteAccess(
    credentialId: credentialId,
    network: .polygonAmoy,
    grants: [
        .nativeTransfer(
            to: "0x1111111111111111111111111111111111111111",
            // Cumulative 0.001 POL limit in wei.
            limit: "1000000000000000"
        )
    ],
    expiresAt: ISO8601DateFormatter().string(
        from: Date().addingTimeInterval(3_600)
    )
)

let details = try await omsWallet.wallet.getRemoteAccessSession(
    sessionId: session.sessionId
)
let usage = try await omsWallet.wallet.getRemoteAccessSessionUsage(
    sessionId: session.sessionId,
    network: .polygonAmoy
)

WaaS caps the requested session expiry at the remote credential’s expiry. Backend credential registration and remote execution are outside the Swift SDK; implement them with the TypeScript SDK’s backend smart sessions guide.

Sign out

try omsWallet.wallet.signOut()

Signing out clears the completed session, Keychain credential, pending redirect state, and pending wallet selection for this SDK scope. It does not revoke other access credentials on the wallet.

​Read restored session state

​Observe expiration

​List, switch, and create wallets

​Import and activate a wallet

​Understand access objects

​Request a wallet ID token

​List and revoke access grants

​Authorize remote access

​Sign out

Read restored session state

Observe expiration

List, switch, and create wallets

Import and activate a wallet

Understand access objects

Request a wallet ID token

List and revoke access grants

Authorize remote access

Sign out