feat: add My Account API support for managing MFA authentication method by utkrishtsahu · Pull Request #835 · auth0/auth0-flutter

utkrishtsahu · 2026-05-20T06:54:07Z

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Adds support for the Auth0 My Account API, enabling end-users to self-manage their MFA authentication methods without requiring Management API tokens.

New public API:

Auth0.myAccount(accessToken:) — factory method returning a MyAccountApi instance
MyAccountApi class with the following methods:
getAuthenticationMethods() — list all enrolled authentication methods
getAuthenticationMethod(id:) — get a specific method by ID
deleteAuthenticationMethod(id:) — delete a method by ID
getFactors() — list available factors on the tenant
enrollPhone(phoneNumber:, type:) — enroll phone (SMS/voice)
enrollEmail(email:) — enroll email OTP
enrollTotp() — enroll TOTP (authenticator app)
enrollPush() — enroll push notifications
enrollRecoveryCode() — enroll recovery codes
verifyOtp(id:, authSession:, otp:) — confirm enrollment with OTP

New types added:

MyAccountApi — main API class
AuthenticationMethod — represents an enrolled MFA method
EnrollmentChallenge — returned by enrollment methods (contains id, authSession, and type-specific fields like totpSecret, totpUri, barcodeUri, recoveryCode)
Factor — represents an available factor (name, enabled)
PhoneType — enum (sms, voice)
MyAccountException — domain exception with statusCode, isNetworkError, isRetryable

Platform implementation:

Android: Auth0FlutterMyAccountMethodCallHandler + 10 individual request handlers via MyAccountAPIClient
iOS/macOS: MyAccountHandler + 10 individual method handlers via Auth0.swift MyAccount client
Method channel: auth0.com/auth0_flutter/my_account

Requires access tokens with audience https://{domain}/me/ and appropriate me scopes (read:me:authentication_methods, create:me:authentication_methods, delete:me:authentication_methods, read:me:factors).

📎 References

SDK-8730

🎯 Testing

Unit tests:

Android: 11 new test files covering all request handlers + method call handler routing (247 tests total, all passing)
iOS: 39 new tests covering all method handlers via spy/mock objects (250 tests total, all passing)

Manual testing:

Tested on iOS Simulator (iPhone 16, iOS 18.4) and Android emulator
Verified full enrollment flow: login with My Account audience → enroll phone (SMS) → verify OTP → list methods → delete method
Verified TOTP enrollment returns correct totpSecret and totpUri for authenticator app integration

Not tested:

Web platform (not supported )

…ios test failure

NandanPrabhu · 2026-05-21T06:00:33Z

+private const val MY_ACCOUNT_DELETE_AUTH_METHOD_METHOD =
+    "myAccount#deleteAuthenticationMethod"
+
+class DeleteAuthenticationMethodRequestHandler :


is final class required here?

NandanPrabhu · 2026-05-21T06:02:01Z

+                override fun onSuccess(
+                    res: AuthenticationMethod
+                ) {
+                    result.success(null)


is flutter compatible with suspend functions?

NandanPrabhu · 2026-05-21T06:07:26Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


Factor has type and usage. Dont we want to pass usage as well to dart?

Agree, usage array should be returned

sanchitmehtagit · 2026-05-21T12:18:18Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


"enabled" : true should this be derived from response.?

pmathew92 · 2026-05-22T10:55:31Z

+                override fun onSuccess(res: List<Factor>) {
+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,


Lets keep it as type only. Its not actually a name thats returned.

pmathew92 · 2026-05-22T10:56:31Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


What exactly does this enabled represent. The API doesn't return an enabled property

pmathew92 · 2026-05-22T10:59:50Z

+        request: MethodCallRequest,
+        result: MethodChannel.Result
+    ) {
+        client.getAuthenticationMethods()


This API now supports a type parameter as input. Android PR is already up.
auth0/Auth0.Android#974
Both platforms will have this out by next week. Update accordingly

pmathew92 · 2026-05-22T11:03:01Z

+                override fun onSuccess(
+                    res: AuthenticationMethod
+                ) {
+                    result.success(null)


Why is the success returning null here. Shouldn't the details from AuthenticationMethod type be returned here ?

pmathew92 · 2026-05-22T11:04:15Z

+        val handler = myAccountRequestHandlers.find { it.method == call.method }
+        if (handler != null) {
+            val accessToken = request.data["accessToken"] as? String ?: ""
+            val client = MyAccountAPIClient(request.account, accessToken)


MyAccountAPI's support DPoP too. Ensure the client created can support DPoP also.
auth0/Auth0.Android#974
This PR adds the support for the same in Android

pmathew92 · 2026-05-22T11:17:25Z

+        put("_statusCode", exception.statusCode)
+        put("_errorFlags", mapOf(
+            "isNetworkError" to exception.isNetworkError,
+        ))


The MyAccountException returns more info which actually represents what went wrong like title, detail etc. These help the customer know what went wrong and also help us debug when an issue arises. Currently the above map captures only the status code, which in itself is not helpful. Add the other properties too

pmathew92 · 2026-05-22T11:18:18Z

+    return buildMap {
+        put("id", id)
+        put("type", type)
+        put("created_at", createdAt)


there is a usage property also

pmathew92 · 2026-05-22T11:19:22Z

+            is PushNotificationAuthenticationMethod -> {
+                put("name", method.name)
+            }
+            else -> {}


Passkey , Recovery code and Password are missing

pmathew92 · 2026-05-22T11:20:39Z

+                put("name", method.name)
+            }
+            is PushNotificationAuthenticationMethod -> {
+                put("name", method.name)


The confirmed property is also missing which is important to know whether a authentication method is verfied or nor

pmathew92 · 2026-05-22T11:22:16Z

+                put("recovery_code", challenge.recoveryCode)
+            }
+            is MfaEnrollmentChallenge -> {}
+            else -> {}


Oob enrollment challenge is missing

feat: add My Account API support for managing MFA authentication method

f89de9e

utkrishtsahu requested a review from a team as a code owner May 20, 2026 06:54

utkrishtsahu temporarily deployed to internal May 20, 2026 06:54 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal May 20, 2026 06:54 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal May 20, 2026 06:54 — with GitHub Actions Inactive

fix: add iOS/macOS symlinks and sort export directives alphabetically

f29c838

utkrishtsahu temporarily deployed to internal May 20, 2026 07:16 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal May 20, 2026 07:16 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal May 20, 2026 07:16 — with GitHub Actions Inactive

fix: add missing valuePublished(byPlugin:) to SpyPluginRegistrar for …

2e3e50c

…ios test failure

utkrishtsahu temporarily deployed to internal May 20, 2026 08:24 — with GitHub Actions Inactive

NandanPrabhu reviewed May 21, 2026

View reviewed changes

sanchitmehtagit reviewed May 21, 2026

View reviewed changes

pmathew92 reviewed May 22, 2026

View reviewed changes

pmathew92 requested changes May 22, 2026

View reviewed changes

Conversation

utkrishtsahu commented May 20, 2026

📋 Changes

📎 References

🎯 Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanchitmehtagit May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmathew92 May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sanchitmehtagit May 21, 2026 •

edited

Loading

pmathew92 May 22, 2026 •

edited

Loading