Post #3794814
2026-02-08 11:38 UTC
A “no account” solution based on CloudKit could look like this:
1. Device fetches S, a user-specific secret, from the user’s private CloudKit DB, creating it if missing.
2. Device authenticates with
HMAC_SHA256(S, token || deviceId || timestamp || nonce)
3. On first registration, the backend learns S and then groups devices by
userId = SHA256(S), verifying the HMAC and rejecting replays via timestamp and nonce.
This proves knowledge of S, and therefore access to the user’s private CloudKit DB.
Replies (1)
-
@simonbs@mastodon.social 2026-02-09 18:28
I’m experimenting with CloudKit’s public database for user-specific data but it makes my brain itch that it’s called “public”. I’m pretty sure I’m using it as intended though. Access is scoped, records are tied to the user’s iCloud account, and nothing is actually truly public. If this holds up, it’s nice. I already sync data in the user’s private database with SwiftData, and this gives me a way to share auxiliary user-bound data with a backend service via CloudKit’s server-to-server support.