Adapters

Adapters supplies what the SDK does not do itself. The SDK holds the device key and runs the protocol. It never asks a person for their secret and never opens a browser. Every Config carries Adapters, the only platform-specific surface.

Field	Required	What it does
unlock	Yes	Obtains the person’s secret for the device key.
signIn	Yes	Opens the identity provider’s authorization URL in the system browser.
attestation	Only on mobile	The platform’s attestation of a session key held in hardware.
offlineMedium	Where the tenant issues one	Reads and writes a custodian’s backup key share.

Your application always supplies unlock. On mobile, the platform SDK ships attestation and a system-browser signIn for you. Everything else in the SDK API is the same call on every platform.

unlock

UnlockAdapter.unlock(purpose) obtains the person’s secret for the device key, however your application does that: a passphrase, a platform biometric prompt, a hardware key. What it returns is typed by each platform SDK.

TypeScript

interface UnlockAdapter {
  unlock(purpose: UnlockPurpose): Promise<unknown>;
}

Swift

protocol UnlockAdapter {
  func unlock(purpose: UnlockPurpose) async throws -> Any
}

Kotlin

interface UnlockAdapter {
  suspend fun unlock(purpose: UnlockPurpose): Any
}

UnlockPurpose says why the SDK asks. Use it to shape the prompt.

Purpose	Asked when
connect	sealdhealthcare.connect(tenantId) unlocks the device key for the first time in this process.
resume	The session went inactive and session.resume() needs the key again, with no identity-provider round trip.
sign	An operation needs this device’s signature after a fresh multi-factor sign-in: an approval, a revoke, a role change.
open-offline	An open falls back to the offline lease and needs the device key to open the copy the offline lease covers.
enroll	A new device generates its device key while enrolling.

signIn

SignInAdapter.authorize(url, redirectUri) opens the identity provider’s authorization URL in the system browser. It returns the redirect URL the browser came back with. The SDK uses PKCE and holds no client secret. The SDK reuses this adapter for stepUp(), a fresh multi-factor sign-in mid-flow, for example after a challenge decision.

TypeScript

interface SignInAdapter {
  authorize(url: string, redirectUri: string): Promise<string>;
}

Swift

protocol SignInAdapter {
  func authorize(url: String, redirectUri: String) async throws -> String
}

Kotlin

interface SignInAdapter {
  suspend fun authorize(url: String, redirectUri: String): String
}

If the person closes the browser or backs out of the identity provider, the call your application made throws SealdHealthcareError with code canceled. Return to what you were doing. This is not a fault.

attestation

On mobile, AttestationAdapter.attest(sessionKeyPublic) returns the platform’s attestation of a session key held in hardware.

TypeScript

interface AttestationAdapter {
  attest(sessionKeyPublic: Bytes): Promise<Bytes>;
}

Swift

protocol AttestationAdapter {
  func attest(sessionKeyPublic: Data) async throws -> Data
}

Kotlin

interface AttestationAdapter {
  suspend fun attest(sessionKeyPublic: ByteArray): ByteArray
}

offlineMedium

The SDK writes a custodian’s backup key share to a hardware token, where the tenant issues one. Otherwise the share is a printed code. OfflineMediumAdapter writes and reads the share.

TypeScript

interface OfflineMediumAdapter {
  write(share: Bytes, fingerprint: string): Promise<void>;
  read(): Promise<Bytes>;
}

Swift

protocol OfflineMediumAdapter {
  func write(share: Data, fingerprint: String) async throws
  func read() async throws -> Data
}

Kotlin

interface OfflineMediumAdapter {
  suspend fun write(share: ByteArray, fingerprint: String)
  suspend fun read(): ByteArray
}

Mobile adapters the platform ships

The mobile SDKs ship the attestation adapter and a system-browser sign-in adapter for you. Your mobile application usually supplies only unlock.

Adapter	Swift	Kotlin
Attestation	AppAttestAdapter()	KeyAttestationAdapter(context)
Sign-in	WebAuthenticationSignIn(presentationAnchor:)	CustomTabsSignIn(activity)

Next

• Quickstart to see unlock and signIn in a working feature.
• Access decisions for SealdHealthcareError and the canceled code.
• Backup key and custodians for offlineMedium end to end.