JWT Tokens in Swift (iOS/macOS)

JWT Tokens in Swift (iOS/macOS): Complete Guide

JSON Web Token (JWT) is a compact, URL-safe way to transmit data between parties in JSON format. In the Apple ecosystem (iOS, macOS, watchOS, tvOS), JWT is widely used for user authentication, information exchange between services, and implementing Single Sign-On. In this article, we will cover how to work with JWT tokens in Swift, which libraries to use, and how to implement the full cycle: from creation to verification.

What is JWT and why is it needed in iOS/macOS?

JWT consists of three parts separated by dots:

Header — contains the token type and signing algorithm (e.g., HS256 or RS256).
Payload — contains the data (claims), such as user ID, expiration time (exp), issuer (iss), and others.
Signature — created based on the header, payload, and secret key (or key pair for asymmetric algorithms).

In mobile applications, JWT is typically used for:

Storing the user session after login.
Transmitting access rights between client and server.
Secure data exchange between microservices.

Popular Libraries for Working with JWT in Swift

There are several proven libraries that simplify working with JWT on Apple platforms:

Swift-JWT (IBM) — one of the most popular, supports HS256, RS256, ES256, and other algorithms, works on iOS, macOS, Linux.
JWTDecode (Auth0) — a lightweight library for decoding and signature verification only (without token creation).
Vapor JWT — for the server side in Swift (Vapor), but can also be used in client projects.
Kitura-CredentialsJWT — part of the Kitura ecosystem from IBM.

In this article, we will focus on the Swift-JWT library, as it is the most versatile and actively maintained.

Installing Swift-JWT via Swift Package Manager (SPM)

Add the dependency to your Package.swift file or via Xcode:

// Package.swiftdependencies: [    .package(url: "https://github.com/Kitura/Swift-JWT.git", from: "4.0.0")],targets: [    .target(name: "YourTarget", dependencies: ["SwiftJWT"])]

Or in Xcode: File → Swift Packages → Add Package Dependency and enter the URL: https://github.com/Kitura/Swift-JWT.git.

Creating a JWT Token Using a Symmetric Key (HS256)

Here is an example of creating a JWT with the HS256 algorithm (symmetric key):

import SwiftJWT

// Define the structure for the payloadstruct MyClaims: Claims {    let sub: String    let exp: Date    let iss: String    let admin: Bool}

// Create the payloadlet claims = MyClaims(    sub: "1234567890",    exp: Date(timeIntervalSinceNow: 3600), // token lives for 1 hour    iss: "pythonlib.ru",    admin: true)

// Create the JWT objectvar jwt = JWT(claims: claims)

// Set the header (optional, defaults to HS256)let header = Header(kid: "my-key-id")jwt.header = header

// Secret key (in a real project, store it in Keychain or .env)let privateKey = "my-secret-key".data(using: .utf8)!

// Sign and get the token stringdo {    let signedJWT = try jwt.sign(using: .hs256(key: privateKey))    print("Created JWT:\\(signedJWT)")} catch {    print("Signing error: \\(error)")}

Verifying and Decoding a JWT

To verify the signature and extract data from the token, use:

let jwtString = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZXhwIjoxNjg5OTk5OTk5LCJpc3MiOiJweXRob25saWIucnUiLCJhZG1


                
    
  Also in library
  
                
                  
                 Machine Learning in Swift: Core ML, Create ML, and TensorFlow Lite Libraries
      
                
                  
                 Pest PHP Testing: Complete Guide with Examples
      
                
                  
                 fx for Go: Complete Guide with Examples
      
                
                  
                 Machine Learning in PHP: Overview of Libraries for ML Integration
      
                
                  
                 ORM for C++: Comparison and Examples of Library Usage