ckWebAuthToken retrieval via postMessage using CloudKit Web Services

Question

I am trying to retrieve a web auth token for CloudKit using their web services and postMessage API token. According to Apple's documentation, token should be returned as part of "data" object through the message callback, but all I am getting is the ckSession variable. It seems like documentation is wrong, or I am missing something.

Is there any additional API which should be called to retrieve the web auth token after this step? I tried being naive and passed ckSession to record listing APIs but that doesn't seem to work. Also, if I use a different token retrieval method, like custom URL scheme, for example, token gets retrieved correctly. This issue seems to only be related to postMessage option.

"Allowed origins" is set to "all domains" and I'm calling auth API from localhost. I am running Windows 10 and am using Chrome browser (if it means anything here, probably not).

It seems like someone had the same issue a couple of years ago and it was posted on the Apple forums, but it hadn't got much love back then.

Any help would be greatly appreciated. Also, I can provide more information, if needed.

Answer 1

From my Testing, ckSession itself is ckWebAuthToken. Encode and append the ckSession string that you received to future requests. To URL encode the ckSession string, replace '+' with '%2B', '/' with '%2F', and '=' with '%3D'.

Answer 2

Likewise, I never managed to intercept the ckWebAuthToken with the postMessage method. I suspect it can be used only with the sign in button generated by setUpAuth in the JS SDK.

So instead I redirected to a page of mine hosted somewhere, where I grabbed the token from the query string and sent it to my host app, all in JavaScript. Clunky but it worked! :)

Answer 3

As I understand it, you can only obtain the web auth token (ckWebAuthToken) via the front-end JavaScript API. It should be returned after the user signs in with their Apple ID. You could then POST that value to your back-end app and store it somehow (probably as a session variable).

You can read more about getting the web auth token on this page.

If you have since learned more about solving this and know more than I do, I'm all ears. :)