feat: add My Account API support for managing MFA authentication method by utkrishtsahu · Pull Request #835 · auth0/auth0-flutter

utkrishtsahu · 2026-05-20T06:54:07Z

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Adds support for the Auth0 My Account API, enabling end-users to self-manage their MFA authentication methods without requiring Management API tokens.

New public API:

Auth0.myAccount(accessToken:) — factory method returning a MyAccountApi instance
MyAccountApi class with the following methods:
getAuthenticationMethods() — list all enrolled authentication methods
getAuthenticationMethod(id:) — get a specific method by ID
deleteAuthenticationMethod(id:) — delete a method by ID
getFactors() — list available factors on the tenant
enrollPhone(phoneNumber:, type:) — enroll phone (SMS/voice)
enrollEmail(email:) — enroll email OTP
enrollTotp() — enroll TOTP (authenticator app)
enrollPush() — enroll push notifications
enrollRecoveryCode() — enroll recovery codes
verifyOtp(id:, authSession:, otp:) — confirm enrollment with OTP

New types added:

MyAccountApi — main API class
AuthenticationMethod — represents an enrolled MFA method
EnrollmentChallenge — returned by enrollment methods (contains id, authSession, and type-specific fields like totpSecret, totpUri, barcodeUri, recoveryCode)
Factor — represents an available factor (name, enabled)
PhoneType — enum (sms, voice)
MyAccountException — domain exception with statusCode, isNetworkError, isRetryable

Platform implementation:

Android: Auth0FlutterMyAccountMethodCallHandler + 10 individual request handlers via MyAccountAPIClient
iOS/macOS: MyAccountHandler + 10 individual method handlers via Auth0.swift MyAccount client
Method channel: auth0.com/auth0_flutter/my_account

Requires access tokens with audience https://{domain}/me/ and appropriate me scopes (read:me:authentication_methods, create:me:authentication_methods, delete:me:authentication_methods, read:me:factors).

📎 References

SDK-8730

🎯 Testing

Unit tests:

Android: 11 new test files covering all request handlers + method call handler routing (247 tests total, all passing)
iOS: 39 new tests covering all method handlers via spy/mock objects (250 tests total, all passing)

Manual testing:

Tested on iOS Simulator (iPhone 16, iOS 18.4) and Android emulator
Verified full enrollment flow: login with My Account audience → enroll phone (SMS) → verify OTP → list methods → delete method
Verified TOTP enrollment returns correct totpSecret and totpUri for authenticator app integration

Not tested:

Web platform (not supported )

…ios test failure

NandanPrabhu · 2026-05-21T06:00:33Z

+private const val MY_ACCOUNT_DELETE_AUTH_METHOD_METHOD =
+    "myAccount#deleteAuthenticationMethod"
+
+class DeleteAuthenticationMethodRequestHandler :


is final class required here?

No, final class is not used here — it's a regular class implementing the MyAccountRequestHandler interface. Since it's implementing an interface, it can't be final. No change needed.

NandanPrabhu · 2026-05-21T06:02:01Z

+                override fun onSuccess(
+                    res: AuthenticationMethod
+                ) {
+                    result.success(null)


is flutter compatible with suspend functions?

Flutter's MethodChannel on Android uses callback-based MethodChannel.Result, not coroutines. The Auth0 Android SDK's Request.start(Callback) pattern is the correct approach for MethodChannel handlers. Suspend functions would require a coroutine scope which adds unnecessary complexity here. This is the same pattern used by all other handlers in the plugin (WebAuth, Auth, CredentialsManager).

NandanPrabhu · 2026-05-21T06:07:26Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


Factor has type and usage. Dont we want to pass usage as well to dart?

Agree, usage array should be returned

Fixed. Updated to pass "type" and "usage" directly from the native Factor object instead of mapping to "name"/"enabled".

sanchitmehtagit · 2026-05-21T12:18:18Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


"enabled" : true should this be derived from response.?

Fixed. Removed enabled entirely — the API doesn't return an enabled property. Replaced with "usage" which is the actual field from the SDK (List? like ["secondary"]).

pmathew92 · 2026-05-22T10:55:31Z

+                override fun onSuccess(res: List<Factor>) {
+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,


Lets keep it as type only. Its not actually a name thats returned.

Fixed. Changed from "name" to it.type to "type" to it.type.

pmathew92 · 2026-05-22T10:56:31Z

+                    result.success(res.map {
+                        mapOf(
+                            "name" to it.type,
+                            "enabled" to true


What exactly does this enabled represent. The API doesn't return an enabled property

You're right — removed it. Replaced with the actual usage array from the SDK. Updated the Dart Factor model accordingly (type + usage instead of name + enabled).

pmathew92 · 2026-05-22T10:59:50Z

+        request: MethodCallRequest,
+        result: MethodChannel.Result
+    ) {
+        client.getAuthenticationMethods()


This API now supports a type parameter as input. Android PR is already up.
auth0/Auth0.Android#974
Both platforms will have this out by next week. Update accordingly

Acknowledged. Will add the optional type filter parameter to getAuthenticationMethods() once Auth0.Android PR #974 is merged and the corresponding Swift SDK update is available. Will address in a follow-up commit/PR.

pmathew92 · 2026-05-22T11:03:01Z

+                override fun onSuccess(
+                    res: AuthenticationMethod
+                ) {
+                    result.success(null)


Why is the success returning null here. Shouldn't the details from AuthenticationMethod type be returned here ?

Fixed. Now returning res.toMyAccountMethodMap() on success. Updated the Dart return type from Future to Future across the platform interface and public API. iOS handler also updated to return method.asDictionary().

pmathew92 · 2026-05-22T11:04:15Z

+        val handler = myAccountRequestHandlers.find { it.method == call.method }
+        if (handler != null) {
+            val accessToken = request.data["accessToken"] as? String ?: ""
+            val client = MyAccountAPIClient(request.account, accessToken)


MyAccountAPI's support DPoP too. Ensure the client created can support DPoP also.
auth0/Auth0.Android#974
This PR adds the support for the same in Android

Acknowledged. Will add DPoP support to the MyAccountAPIClient creation once Auth0.Android PR #974 is merged and the Swift SDK adds equivalent support. This will involve passing a useDPoP flag from Dart and configuring the client accordingly. Will address in a follow-up once both native SDKs have this merged.

pmathew92 · 2026-05-22T11:17:25Z

+        put("_statusCode", exception.statusCode)
+        put("_errorFlags", mapOf(
+            "isNetworkError" to exception.isNetworkError,
+        ))


The MyAccountException returns more info which actually represents what went wrong like title, detail etc. These help the customer know what went wrong and also help us debug when an issue arises. Currently the above map captures only the status code, which in itself is not helpful. Add the other properties too

Fixed. Added title and detail to the error map on both Android and iOS. Also exposed them as first-class properties on the Dart MyAccountException class (exception.title, exception.detail).

pmathew92 · 2026-05-22T11:18:18Z

+    return buildMap {
+        put("id", id)
+        put("type", type)
+        put("created_at", createdAt)


there is a usage property also

Fixed. Added usage to the AuthenticationMethod serialization (inside the MfaAuthenticationMethod check alongside confirmed). Also added it to the Dart model.

pmathew92 · 2026-05-22T11:19:22Z

+            is PushNotificationAuthenticationMethod -> {
+                put("name", method.name)
+            }
+            else -> {}


Passkey , Recovery code and Password are missing

Added an else branch that sets name to null for unhandled subtypes (Passkey, RecoveryCode, Password). These types don't have additional properties beyond the base id, type, createdAt that are already serialized for all AuthenticationMethod instances. Full passkey enrollment support is deferred to a future release due to WebAuthn/FIDO2 platform complexity.

pmathew92 · 2026-05-22T11:20:39Z

+                put("name", method.name)
+            }
+            is PushNotificationAuthenticationMethod -> {
+                put("name", method.name)


The confirmed property is also missing which is important to know whether a authentication method is verfied or nor

Fixed. confirmed was already being serialized on Android (inside the MfaAuthenticationMethod check at line 39). Also added it to the iOS AuthenticationMethod.asDictionary() and the Dart AuthenticationMethod model so it's accessible as method.confirmed.

pmathew92 · 2026-05-22T11:22:16Z

+                put("recovery_code", challenge.recoveryCode)
+            }
+            is MfaEnrollmentChallenge -> {}
+            else -> {}


Oob enrollment challenge is missing

Acknowledged. Will add OOB (Out-of-Band) enrollment challenge support in a follow-up once the full OOB enrollment flow is confirmed across both native SDKs.

… mapping Signed-off-by: utkrishtS <utkrisht.sahu@okta.com>

… models and verifyOtp return type

feat: add My Account API support for managing MFA authentication method

f89de9e

utkrishtsahu requested a review from a team as a code owner May 20, 2026 06:54

utkrishtsahu temporarily deployed to internal May 20, 2026 06:54 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal May 20, 2026 06:54 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal May 20, 2026 06:54 — with GitHub Actions Inactive

fix: add iOS/macOS symlinks and sort export directives alphabetically

f29c838

utkrishtsahu temporarily deployed to internal May 20, 2026 07:16 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal May 20, 2026 07:16 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal May 20, 2026 07:16 — with GitHub Actions Inactive

fix: add missing valuePublished(byPlugin:) to SpyPluginRegistrar for …

2e3e50c

…ios test failure

utkrishtsahu temporarily deployed to internal May 20, 2026 08:24 — with GitHub Actions Inactive

NandanPrabhu reviewed May 21, 2026

View reviewed changes

sanchitmehtagit reviewed May 21, 2026

View reviewed changes

pmathew92 reviewed May 22, 2026

View reviewed changes

pmathew92 requested changes May 22, 2026

View reviewed changes

utkrishtsahu added 2 commits May 25, 2026 11:57

fix: use barcodeUri for totp_uri in Android TOTP enrollment challenge…

efc7a35

… mapping Signed-off-by: utkrishtS <utkrisht.sahu@okta.com>

merge: resolve conflict with origin/main (Windows Desktop support)

8565baa

utkrishtsahu temporarily deployed to internal May 25, 2026 06:36 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal May 25, 2026 06:36 — with GitHub Actions Error

utkrishtsahu temporarily deployed to internal May 25, 2026 06:36 — with GitHub Actions Inactive

fix: address PR review feedback - correct Factor/AuthenticationMethod…

7722a35

… models and verifyOtp return type

utkrishtsahu had a problem deploying to internal May 25, 2026 07:04 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal May 25, 2026 07:04 — with GitHub Actions Inactive

utkrishtsahu deployed to internal May 25, 2026 08:41 — with GitHub Actions Active

Conversation

utkrishtsahu commented May 20, 2026

📋 Changes

📎 References

🎯 Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanchitmehtagit May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmathew92 May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sanchitmehtagit May 21, 2026 •

edited

Loading

pmathew92 May 22, 2026 •

edited

Loading