Authentication

TrainingKit has two runtime authentication contracts, plus a build-time key used only for schema introspection. The contracts themselves are defined in the API section; this page shows how each one surfaces in the iOS SDK.

The two runtime contracts

Contract	What it protects	How it travels	Required?
API Authentication	Your B2B API perimeter — only your authenticated backend context can call the API	A backend-issued JWT sent on your GraphQL requests	When enabled in your Admin Console (recommended for production)
SDK Authentication	TrainingKit integrity — blocks forged, modified, or replayed workout payloads	The X-TrainingKit-Device handshake that returns a TrainingKitToken, passed to the workout controller	Always — it is mandatory to launch a workout

Full reference:

• API Authentication
• SDK Authentication

API Authentication (request JWT)

Your backend issues a short-lived JWT (signed with your RSA/ECDSA key, carrying a sub claim for the end user) and your app attaches it to every GraphQL request — typically an Authorization: Bearer <jwt> header. The API layer validates it; the SDK does not. This layer is turned on and configured (public keys, JWKS/PEM) by the B2B client in the Admin Console.

Add it in your request interceptor:

// DemoHeadersAddingInterceptor
request.addValue("Bearer \(backendJWT)", forHTTPHeaderField: "Authorization")

Issue the JWT server-side only; never embed the signing key in the app.

SDK Authentication (device handshake + TrainingKitToken)

Launching a workout requires a device-bound token. Send the SDK device identifier on the session request, then pass the returned TrainingKitToken to the controller.

1. Attach the device id to the publicWorkoutSession request:

   request.addValue(TrainingKitConfig.deviceId(), forHTTPHeaderField: "X-TrainingKit-Device")

2. Read the TrainingKitToken from the response — GraphQL extensions.trainingkit.token, the trainingKitToken field on the session, or the X-TrainingKit-Token header:

   guard let wk = response.extensions?["trainingkit"] as? [String: String],
         let token = wk["token"] else { return }

3. Pass it when you launch:

   let controller = try await ClassicWorkoutController(data: data, token: token)

The token is valid for one day and is bound to the current app lifecycle, so fetch the session shortly before launch. See SDK Authentication for lifecycle, caching, and refresh rules.

Build-time only: X-Developer-Authorization-Key

This is not a runtime credential. It unlocks GraphQL schema introspection (for the Admin Console Playground or code generation) and is retrieved from your Admin Console API settings.

Use it only on developer machines or CI, for tooling such as Apollo schema download. Never ship it in the app build or hard-code it in source that ends up in the binary.