Thinking out loud - first confirming the underlying problem:
You need the user to be able to log into the iOS app and provide access to the WP site.
Ongoing review: a user ID + password + salt (or something similar) is created in the iOS and wordpress application. Use this hash sent via the iOS app in WP to confirm the user.
Yes, there are security issues associated with this information passing through the air, just as your username and PW will go through the air.
Using a suitable hash (using the lookup table in WP, very simple), there are methods in WP to force the user to log in (this is done, you can dig code assistants from my archives).
Problem: It is necessary to translate the PW change into hash generation / update. WP has custom interceptors that are very solvable.
Good to know: almost all aspects of user management, including permissions and groups, are available through the WP API / framework. Itβs possible (though not easy) to swap PW with an iOS app that will update WP and much more.
I hope I helped you, the messages are a bit confusing.
source share