Others

How to Authenticate Salesforce in an iOS App Without WebView

Muhammad Talha Oct 23, 2026 868 views

Question details

Developers need a secure, modern authentication method for connecting an iOS application to the Salesforce REST API to retrieve user records without relying on traditional WebViews.

How to Authenticate Salesforce in an iOS App Without the Salesforce WebView

Product: Salesforce REST API and iOS SDK
Device & OS: iOS
Scenario: Building an iPhone application that requires secure retrieval of user-specific Salesforce data via REST API.
Observed behavior: Seeking a secure alternative to embedding an insecure custom login page or UIWebView for handling Salesforce user authentication.

Before you start

Ensure you have administrator access to your Salesforce org to create a Connected App, and verify that your iOS development environment is ready for handling OAuth 2.0 flows.

Solution 1Recommended

Implement Standard Salesforce OAuth 2.0 Authentication

Use the OAuth 2.0 User-Agent flow to authenticate users securely without embedding a raw WebView inside your iOS app.

By utilizing the standard OAuth 2.0 flow along with iOS security components like ASWebAuthenticationSession, developers can ensure a safe login experience that prevents the host application from sniffing user credentials.

Create a Connected App in Salesforce

Log in to your Salesforce setup, navigate to the App Manager, and click 'New Connected App'. Fill in the required details and enable OAuth Settings.

Configure OAuth Scopes and Callback URL

Set your application's unique Callback URL. Under Selected OAuth Scopes, add 'Access and manage your data (api)' and 'Perform requests on your behalf at any time (refresh_token)'.

Implement ASWebAuthenticationSession

In your iOS app's Swift code, use ASWebAuthenticationSession to securely open the Salesforce authorization URL. This hands the login process to a secure, isolated system browser instance.

Capture and Store Tokens

Once the user authenticates, capture the access token and refresh token from the callback URL fragment. Store these tokens securely in the iOS Keychain.

Authorize REST API Requests

Attach the saved access token in the Authorization header (e.g., 'Bearer <access_token>') for all subsequent requests to the Salesforce REST API.

Implement Standard Salesforce OAuth 2.0 Authentication

Security Tip: Always use the iOS Keychain rather than UserDefaults for storing access and refresh tokens to prevent unauthorized data access.

Solution 2

Utilize the Official Salesforce Mobile SDK for iOS

Leverage the official SDK to handle complex authentication flows, secure storage, and API routing out of the box.

Free Microsoft Office alternative

Manage Your App Development Documentation with WPS Office

While WPS Office does not resolve iOS SDK authentication issues, it serves as an excellent, lightweight alternative to Microsoft Office. It helps developers create API documentation, track project requirements, and collaborate on codebase notes efficiently and for free.

Free, lightweight, and incredibly fast to launchHighly compatible with Microsoft Word, Excel, and PowerPoint formatsPerfect for writing API documentation and formatting code snippetsFamiliar user interface ensures a seamless migration from Microsoft Office

Frequently Asked Questions

Why shouldn't I use a standard UIWebView or WKWebView for Salesforce login in iOS?

Using a standard WebView for authentication is considered a severe security risk because the host application can intercept user keystrokes and credentials. Apple and Salesforce strongly recommend using ASWebAuthenticationSession or the official Mobile SDK to isolate the login process.

What OAuth scopes are strictly necessary for retrieving Salesforce REST API data?

Typically, you will need the 'api' scope to access REST APIs, and the 'refresh_token' (or 'offline_access') scope to obtain a refresh token. This allows your iOS app to keep the user logged in without requiring them to constantly re-enter their credentials.

Where should I store the Salesforce access token in my iOS app?

Tokens should always be securely stored in the iOS Keychain. Avoid saving sensitive authentication tokens in UserDefaults or plain text files, as these can be easily compromised on jailbroken devices or extracted from app backups.

Office Quick Solutions