SDK & API updates

​

Mobile SDKs

• Flutter gains push.updateCredential for refreshing push tokens, matching the other mobile SDKs. Flutter 3.1.0.
• Push credentials support expiry and keep-alive. updateCredential accepts a resetExpiry flag, and credentials expose an expiresAt timestamp. iOS 2.12.0, Android 4.2.0, React Native 3.2.0, Flutter 3.2.0.
• Fetching push challenges now returns the challenge’s expiresAt. iOS 2.13.0, Android 4.3.0, React Native 3.3.0, Flutter 3.3.0.

​

Web SDK

• Deprecates the passkey availability check and aligns passkey and push types with the Client API. Browser 1.19.2.

​

Server SDKs

• Webhook payloads now support structured values such as customVariables, plus new helpers for batched log events. Breaking change to webhook event types. Node 3.0.0, Java 3.0.0, .NET 5.0.0.
• The Go SDK adds webhook signature verification, structured values, and batched log events. Go 2.2.0.

​

Webhooks

• New authenticator.updated event fires when a device refreshes its push token or resets its credential expiry.
• email.created and sms.created events now include customVariables.

​

Management API

• New endpoints to get and update message overrides, plus a catalog of available override IDs and locales.

​

Terraform provider

• Custom data points gain an is_public attribute. Terraform 2.1.0.
• New authsignal_message_overrides resource and catalog data source for managing message overrides in Terraform. Terraform 2.2.0.

​

Mobile SDKs

• Fetching push challenges now returns public custom action and user data points, for building richer push verification screens. iOS 2.9.0, Android 3.10.0, React Native 2.13.0, Flutter 2.4.2.
• Passkey sync via the WebAuthn Signal API comes to mobile. Passkeys removed server-side are now reflected in the platform’s passkey UI. iOS 2.10.0, Android 3.11.0, React Native 2.14.0, Flutter 2.7.0.
• Flutter’s push.addCredential now accepts an optional pushToken to register the device token at enrolment. Flutter 2.6.0.
• The Android SDK upgrades to Ktor 3, a major version bump that also rolls through the Flutter and React Native wrappers. Android 4.0.0, React Native 3.0.0, Flutter 3.0.0.
• New push.updateCredential refreshes a device’s push token after enrolment, with no user session or track call required. iOS 2.11.0, Android 4.1.0, React Native 3.1.0.

​

Web SDK

• Adds a targeted push authenticator challenge that sends the push to a specific enrolled device. Browser 1.18.0.
• Passkey authentication now supports immediate mediation. Browser 1.19.0.

​

Mobile SDKs

• App Attest now uses a server-issued nonce in place of the token’s idempotencyKey, and Flutter gains App Attest support. iOS 2.7.0, Android 3.8.0, React Native 2.11.0, Flutter 2.4.0.
• push.enroll accepts an optional pushToken to register the device token at enrolment. iOS 2.8.0, Android 3.9.0, React Native 2.12.0.
• Flutter 2.4.0: adds getDeviceId(), passkey isSupported() / shouldPromptToCreatePasskey(), credential options for push / QR / in-app, a full PIN API, and Flutter web support.

​

Web SDK

• Passkey sync via the WebAuthn Signal API. Passkeys removed server-side are now reflected in the browser’s passkey picker. Browser 1.17.0.

​

Server SDKs

• .NET 4.4.0: adds Username on authenticator enrolment models.

​

Server API

• OIDC redirect flow now uses an opaque authorizationToken plus a client-generated codeVerifier / codeChallenge.
• Update device accepts a rememberedUntil timestamp.
• Passkey authenticator responses include the WebAuthn username.