Ground truth: CometChatUIKitSwift 5.1.22 + CometChatSDK 4.1.7 (symbols verified vs catalogs/ios-v5.json). The login/auth-token API is FETCHED via cometchat-ios-core/references/docs-map.md; the REST auth-token endpoint is {DOCS_BASE}/rest-api/auth-tokens. The iOS UI Kit docs have no single production-hardening page — this checklist is the pack's own guidance from RULES.md §4 + cometchat-ios-core/references/setup-credentials.md, labelled as such. Tracked DOCS GAP.

Companion skills (read first)

cometchat-ios-core — references/setup-credentials.md (the Secrets.xcconfig → Info.plist → Bundle.main flow) and references/swiftui.md (the init→login launch hook) this hardens.
cometchat-security — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is not an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.

Use this skill when

Moving off the development setup: TestFlight/App Store submission, a security review, or "is this safe to ship."

The one thing that matters

Never embed the Auth Key in the app binary.

The Auth Key can mint a session for any user in your app. Anything baked into the app — an xcconfig value promoted into Info.plist, a string constant — is recoverable from the shipped .ipa (strings, class-dump). Treat it as public.

cometchat-ios-production

Companion skills (read first)

Use this skill when

The one thing that matters