cryptotokenkit

Guidance for using Apple's CryptoTokenKit framework to access hardware security tokens and smart cards from Swift 6.3 apps. The framework bridges smart cards and USB tokens with authentication and keychain services across Apple platforms, with capability gated by extension point, entitlement, hardware, and OS version. It covers three usage modes. Smart-card token extensions are macOS app extensions that expose a hardware token's cryptographic items to system login and keychain unlock; such an extension comprises a TokenDriver (subclassing TKSmartCardTokenDriver), a Token (subclassing TKSmartCardToken) that reads certificates and keys and fills its keychainContents, and a TokenSession (subclassing TKSmartCardTokenSession) that reports supported algorithms and performs signing, decryption, and key-exchange operations through its delegate. Client-side token access lets ordinary apps query the keychain for token-backed items (via kSecAttrTokenID) that appear as standard entries when a token is present. NFC smart-card access, new in iOS and iPadOS 26, creates a temporary NFC slot and communicates with a contactless card through TKSmartCard, with registration for later keychain use. The skill documents the key types - TKTokenDriver/TKToken/TKTokenSession, TKSmartCard and TKSmartCardSlotManager (whose default is optional and returns nil unless smart-card access is enabled), TKTokenWatcher for insertion and removal, and the iOS 26 NFC session and registration managers - along with PIN entry by returning a TKTokenAuthOperation such as TKTokenSmartCardPINAuthOperation from beginAuthFor:, and the required Info.plist keys (NSExtensionPointIdentifier com.apple.ctk-tokens naming the driver class) plus one-time registration by launching the host app as the _securityagent user. It also sets boundaries: passkeys, WebAuthn, and account sign-in route to an authentication skill, while Secure Enclave, CryptoKit primitives, keychain architecture, certificate pinning, and trust policy route to swift-security.