SDK & API updates

​

Mobile SDKs

• Flutter supports Swift Package Manager on iOS, alongside CocoaPods. Flutter 3.3.1.
• Fixes launch returning null on Android when the host activity resumes while the browser is open. React Native 3.3.1.

​

Web SDK

• push.challenge returns deliveryResults, and authenticators carry erroredAt and errorCode. Browser 1.20.0.
• Passkey sign-in accepts an idempotencyKey. Browser 1.21.0, 1.21.1.

​

Server SDKs

• Authenticators carry deviceName, erroredAt, and errorCode. Node 3.1.0.

​

Client API

• Start Push Challenge now returns deliveryResults, the per-device outcome of sending the push notification for tenants using APNs or FCM directly. Failed sends are also recorded on the authenticator as erroredAt and errorCode - returned by Get Authenticators on both the Client API and Server API. See Detecting invalid push tokens.
• Initiate Challenge accepts an optional idempotencyKey for the action the passkey sign-in creates.

​

Webhooks

• authenticator.created, authenticator.updated, and authenticator.deleted events now include the actionCode and idempotencyKey of the user action the authenticator change happened during. Together with userId, these identify the action, so you can retrieve it from the event.

​

Management API

• Update Theme takes links.underline, shadows.enabled, container.exitPosition, and a button typeface role.

​

Terraform provider

• Breaking change: dark_mode.typography is removed, and typography moves to text and display roles that each take a faces list. Terraform 3.0.0, v3 upgrade guide.
• authsignal_theme gains the link underline and shadow switches, the container exit position, and a button typeface. Terraform 3.1.0, 3.2.0, 3.3.0.
• New authsignal_pre_built_ui_settings resource for configuration as code. Terraform 3.3.0.

​

Mobile SDKs

• Flutter gains push.updateCredential for refreshing push tokens, matching the other mobile SDKs. Flutter 3.1.0.
• Push credentials support expiry and keep-alive. updateCredential accepts a resetExpiry flag, and credentials expose an expiresAt timestamp. iOS 2.12.0, Android 4.2.0, React Native 3.2.0, Flutter 3.2.0.
• Fetching push challenges now returns the challenge’s expiresAt. iOS 2.13.0, Android 4.3.0, React Native 3.3.0, Flutter 3.3.0.

​

Web SDK

• Deprecates the passkey availability check and aligns passkey and push types with the Client API. Browser 1.19.2.

​

Server SDKs

• Webhook payloads now support structured values such as customVariables, plus new helpers for batched log events. Breaking change to webhook event types. Node 3.0.0, Java 3.0.0, .NET 5.0.0.
• The Go SDK adds webhook signature verification, structured values, and batched log events. Go 2.2.0.

​

Webhooks

• New authenticator.updated event fires when a device refreshes its push token or resets its credential expiry.
• email.created and sms.created events now include customVariables.

​

Management API

• New endpoints to get and update message overrides, plus a catalog of available override IDs and locales.

​

Terraform provider

• Custom data points gain an is_public attribute. Terraform 2.1.0.
• New authsignal_message_overrides resource and catalog data source for managing message overrides in Terraform. Terraform 2.2.0.

​

Mobile SDKs

• Fetching push challenges now returns public custom action and user data points, for building richer push verification screens. iOS 2.9.0, Android 3.10.0, React Native 2.13.0, Flutter 2.4.2.
• Passkey sync via the WebAuthn Signal API comes to mobile. Passkeys removed server-side are now reflected in the platform’s passkey UI. iOS 2.10.0, Android 3.11.0, React Native 2.14.0, Flutter 2.7.0.
• Flutter’s push.addCredential now accepts an optional pushToken to register the device token at enrolment. Flutter 2.6.0.
• The Android SDK upgrades to Ktor 3, a major version bump that also rolls through the Flutter and React Native wrappers. Android 4.0.0, React Native 3.0.0, Flutter 3.0.0.
• New push.updateCredential refreshes a device’s push token after enrolment, with no user session or track call required. iOS 2.11.0, Android 4.1.0, React Native 3.1.0.

​

Web SDK

• Adds a targeted push authenticator challenge that sends the push to a specific enrolled device. Browser 1.18.0.
• Passkey authentication now supports immediate mediation. Browser 1.19.0.

​

Mobile SDKs

• App Attest now uses a server-issued nonce in place of the token’s idempotencyKey, and Flutter gains App Attest support. iOS 2.7.0, Android 3.8.0, React Native 2.11.0, Flutter 2.4.0.
• push.enroll accepts an optional pushToken to register the device token at enrolment. iOS 2.8.0, Android 3.9.0, React Native 2.12.0.
• Flutter 2.4.0: adds getDeviceId(), passkey isSupported() / shouldPromptToCreatePasskey(), credential options for push / QR / in-app, a full PIN API, and Flutter web support.

​

Web SDK

• Passkey sync via the WebAuthn Signal API. Passkeys removed server-side are now reflected in the browser’s passkey picker. Browser 1.17.0.

​

Server SDKs

• .NET 4.4.0: adds Username on authenticator enrolment models.

​

Server API

• OIDC redirect flow now uses an opaque authorizationToken plus a client-generated codeVerifier / codeChallenge.
• Update device accepts a rememberedUntil timestamp.
• Passkey authenticator responses include the WebAuthn username.