---
title: "Secure Authentication with a Push Notification in Your iOS Device"
description: "The tutorial shows how to build a native iOS sign-in flow using Okta DirectAuth and push notification MFA. It starts with an Okta Integrator Free Plan org, configures an OIDC Native Application and enables Okta Verify push notifications, while noting additional authorization policies may be required for a custom authorization server. In Xcode, the app uses Swift, SwiftUI, Swift Package Manager, and the Okta mobile Swift packages OktaDirectAuth and AuthFoundation to handle credentials, tokens, and MFA challenges without browser redirects. An AuthService coordinates authentication state, user and token information, sign-out, access-token refresh, and session restoration from stored credentials. The completed flow is described as phishing-resistant and able to maintain an active session directly within a SwiftUI app."
---

# Secure Authentication with a Push Notification in Your iOS Device

[Okta](https://yomu.fyi/company/okta) · Darko Spasovski · Nov 18, 2025

**Type:** Tutorial

## Summary

The tutorial shows how to build a native iOS sign-in flow using Okta DirectAuth and push notification MFA. It starts with an Okta Integrator Free Plan org, configures an OIDC Native Application and enables Okta Verify push notifications, while noting additional authorization policies may be required for a custom authorization server. In Xcode, the app uses Swift, SwiftUI, Swift Package Manager, and the Okta mobile Swift packages OktaDirectAuth and AuthFoundation to handle credentials, tokens, and MFA challenges without browser redirects. An AuthService coordinates authentication state, user and token information, sign-out, access-token refresh, and session restoration from stored credentials. The completed flow is described as phishing-resistant and able to maintain an active session directly within a SwiftUI app.

## Context

The guide addresses the challenge of providing iOS authentication that feels immediate while using strong safeguards such as multi-factor authentication. It focuses on native, phishing-resistant sign-in without sending users to a browser or SafariViewController.

## Approach / What changed

The implementation configures Okta DirectAuth, OIDC, and Okta Verify push notifications, then integrates OktaDirectAuth and AuthFoundation through Swift Package Manager. A SwiftUI app uses an AuthService to manage authentication state, tokens, user information, sign-out, refreshes, and restoration of an existing session.

## Takeaways

- Okta DirectAuth lets the iOS app handle credential verification, token acquisition, and push notification challenges within native UI without browser redirects.
- Okta Verify Push is enabled as the MFA factor and can be combined with Face ID, Touch ID, or device PIN enforcement for phishing-resistant verification.
- The AuthService refreshes tokens when needed and restores an authorized state from Credential.default when the app restarts; the guide also recommends Refresh Token Rotation.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [iOS](https://yomu.fyi/topic/ios), [MFA](https://yomu.fyi/topic/mfa), [OAuth2](https://yomu.fyi/topic/oauth2), [Swift](https://yomu.fyi/topic/swift)

- Source: [Okta](https://developer.okta.com/blog/2025/11/18/okta-ios-directauth)
- Source URL: https://developer.okta.com/blog/2025/11/18/okta-ios-directauth
- Ingested by Yomu: 2026-09-09T08:43:32.864Z

[Read original post](https://developer.okta.com/blog/2025/11/18/okta-ios-directauth)