SDK & API updates

​

Mobile SDKs

• New .NET MAUI SDK. MAUI 0.1.0.
• Fixes in-app PIN errors and passkey enrollment cancellation, and Android no longer clears the token after a failed verification. iOS 2.13.2, 2.13.3, Android 4.3.2, React Native 3.3.4, Flutter 3.3.3.

​

Web SDK

• Starting a passkey sign-in cancels a pending autofill request, fixing “A request is already pending” errors. Browser 1.22.0.

​

Server SDKs

• UserAttributes adds EmailVerified and PhoneNumberVerified. .NET 5.1.2.

​

Client API

• SMS, WhatsApp, email OTP, and magic link sends return retryAfterSeconds when rate limited, for example Start SMS Challenge.
• Sends return a 400 destination_blocked error when the provider blocks the email address or phone number.
• Removing a user’s last passkey is refused when preventRemovingLastPasskey is on.

​

Webhooks

• challenge.log_created adds EMAIL_DESTINATION_BLOCKED, SMS_DESTINATION_BLOCKED, and WHATSAPP_DESTINATION_BLOCKED.

​

Management API

• Passkey configuration takes preventRemovingLastPasskey.
• Sending rate limits accept windows under a minute, such as windowInMinutes: 0.5 for 30 seconds.

​

Terraform provider

• authsignal_passkey_authenticator_configuration takes prevent_removing_last_passkey. Terraform 3.12.0.

​

Mobile SDKs

• Fixes iOS passkey sign-in ignoring the allowed credentials list. iOS 2.13.1, React Native 3.3.2, Flutter 3.3.2.

​

Server API

• Initiate Challenge returns retryAfterSeconds when rate limited.

​

Webhooks

• New authenticator.expired event.
• email.created includes ipCity and ipCountry for magic links.
• New UK (London) webhook IP addresses.

​

Management API

• New endpoints for SMS OTP, email OTP, passkey, and push authenticator configurations. SMS and email OTP accept a WEBHOOK provider.
• Update Tenant takes webhook settings and a Server API ipWhitelist.
• Update Theme takes darkMode.shadows, per axis container padding, and typeface sizeAdjust.

​

Terraform provider

• New authenticator configuration resources and authsignal_tenant_settings. Terraform 3.7.0, 3.8.0, 3.11.0.
• authsignal_theme gains dark_mode.shadows, per axis container padding, and typeface size_adjust. Terraform 3.4.0, 3.9.0, 3.10.0.

​

Mobile SDKs

• Flutter supports Swift Package Manager on iOS, alongside CocoaPods. Flutter 3.3.1.
• Fixes launch returning null on Android when the host activity resumes while the browser is open. React Native 3.3.1.

​

Web SDK

• push.challenge returns deliveryResults, and authenticators carry erroredAt and errorCode. Browser 1.20.0.
• Passkey sign-in accepts an idempotencyKey. Browser 1.21.0, 1.21.1.

​

Server SDKs

• Authenticators carry deviceName, erroredAt, and errorCode. Node 3.1.0.

​

Client API

• Start Push Challenge now returns deliveryResults, the per-device outcome of sending the push notification for tenants using APNs or FCM directly. Failed sends are also recorded on the authenticator as erroredAt and errorCode - returned by Get Authenticators on both the Client API and Server API. See Detecting invalid push tokens.
• Initiate Challenge accepts an optional idempotencyKey for the action the passkey sign-in creates.

​

Webhooks

• authenticator.created, authenticator.updated, and authenticator.deleted events now include the actionCode and idempotencyKey of the user action the authenticator change happened during. Together with userId, these identify the action, so you can retrieve it from the event.

​

Management API

• Update Theme takes links.underline, shadows.enabled, container.exitPosition, and a button typeface role.

​

Terraform provider

• Breaking change: dark_mode.typography is removed, and typography moves to text and display roles that each take a faces list. Terraform 3.0.0, v3 upgrade guide.
• authsignal_theme gains the link underline and shadow switches, the container exit position, and a button typeface. Terraform 3.1.0, 3.2.0, 3.3.0.
• New authsignal_pre_built_ui_settings resource for configuration as code. Terraform 3.3.0.

​

Mobile SDKs

• Flutter gains push.updateCredential for refreshing push tokens, matching the other mobile SDKs. Flutter 3.1.0.
• Push credentials support expiry and keep-alive. updateCredential accepts a resetExpiry flag, and credentials expose an expiresAt timestamp. iOS 2.12.0, Android 4.2.0, React Native 3.2.0, Flutter 3.2.0.
• Fetching push challenges now returns the challenge’s expiresAt. iOS 2.13.0, Android 4.3.0, React Native 3.3.0, Flutter 3.3.0.

​

Web SDK

• Deprecates the passkey availability check and aligns passkey and push types with the Client API. Browser 1.19.2.

​

Server SDKs

• Webhook payloads now support structured values such as customVariables, plus new helpers for batched log events. Breaking change to webhook event types. Node 3.0.0, Java 3.0.0, .NET 5.0.0.
• The Go SDK adds webhook signature verification, structured values, and batched log events. Go 2.2.0.

​

Webhooks

• New authenticator.updated event fires when a device refreshes its push token or resets its credential expiry.
• email.created and sms.created events now include customVariables.

​

Management API

• New endpoints to get and update message overrides, plus a catalog of available override IDs and locales.

​

Terraform provider

• Custom data points gain an is_public attribute. Terraform 2.1.0.
• New authsignal_message_overrides resource and catalog data source for managing message overrides in Terraform. Terraform 2.2.0.

​

Mobile SDKs

• Fetching push challenges now returns public custom action and user data points, for building richer push verification screens. iOS 2.9.0, Android 3.10.0, React Native 2.13.0, Flutter 2.4.2.
• Passkey sync via the WebAuthn Signal API comes to mobile. Passkeys removed server-side are now reflected in the platform’s passkey UI. iOS 2.10.0, Android 3.11.0, React Native 2.14.0, Flutter 2.7.0.
• Flutter’s push.addCredential now accepts an optional pushToken to register the device token at enrollment. Flutter 2.6.0.
• The Android SDK upgrades to Ktor 3, a major version bump that also rolls through the Flutter and React Native wrappers. Android 4.0.0, React Native 3.0.0, Flutter 3.0.0.
• New push.updateCredential refreshes a device’s push token after enrollment, with no user session or track call required. iOS 2.11.0, Android 4.1.0, React Native 3.1.0.

​

Web SDK

• Adds a targeted push authenticator challenge that sends the push to a specific enrolled device. Browser 1.18.0.
• Passkey authentication now supports immediate mediation. Browser 1.19.0.

​

Mobile SDKs

• App Attest now uses a server-issued nonce in place of the token’s idempotencyKey, and Flutter gains App Attest support. iOS 2.7.0, Android 3.8.0, React Native 2.11.0, Flutter 2.4.0.
• push.enroll accepts an optional pushToken to register the device token at enrollment. iOS 2.8.0, Android 3.9.0, React Native 2.12.0.
• Flutter 2.4.0: adds getDeviceId(), passkey isSupported() / shouldPromptToCreatePasskey(), credential options for push / QR / in-app, a full PIN API, and Flutter web support.

​

Web SDK

• Passkey sync via the WebAuthn Signal API. Passkeys removed server-side are now reflected in the browser’s passkey picker. Browser 1.17.0.

​

Server SDKs

• .NET 4.4.0: adds Username on authenticator enrollment models.

​

Server API

• OIDC redirect flow now uses an opaque authorizationToken plus a client-generated codeVerifier / codeChallenge.
• Update device accepts a rememberedUntil timestamp.
• Passkey authenticator responses include the WebAuthn username.