Skip to content

refactor : Deprecate the existing MFA APIs in AuthenticationAPIClient #932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pmathew92 merged 4 commits into from
Mar 9, 2026
Merged

refactor : Deprecate the existing MFA APIs in AuthenticationAPIClient #932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
58582b7
deprecate : Deprecate the existing MFA APIs in favor of the new MfaAp…
pmathew92 Mar 6, 2026
b2c4106
Updated the comments to a single line
pmathew92 Mar 6, 2026
347a57d
Updated the examples file
pmathew92 Mar 6, 2026
79ae761
Merge branch 'main' into deprecate_mfa
pmathew92 Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions EXAMPLES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,6 +423,8 @@ authentication

> The default scope used is `openid profile email`. Regardless of the scopes set to the request, the `openid` scope is always enforced.

> **Note** : The MFA APIs in Authentication client has been deprecated. Use the new MFA Flexible Factors APIs

### MFA Flexible Factors Grant

> [!IMPORTANT]
Expand Down
17 changes: 17 additions & 0 deletions auth0/src/main/java/com/auth0/android/authentication/AuthenticationAPIClient.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ public class AuthenticationAPIClient @VisibleForTesting(otherwise = VisibleForTe
return loginWithToken(requestParameters)
}


/**
* Log in a user using the One Time Password code after they have received the 'mfa_required' error.
* The MFA token tells the server the username or email, password, and realm values sent on the first request.
Expand All @@ -196,6 +197,10 @@ public class AuthenticationAPIClient @VisibleForTesting(otherwise = VisibleForTe
* MFA application such as Google Authenticator or Guardian.
* @return a request to configure and start that will yield [Credentials]
*/
@Deprecated(
Copy link
Contributor

@utkrishtsahu utkrishtsahu Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please make it in one line :
message = "loginWithOTP is deprecated and will be removed in the next major version. Use MfaApiClient.verify(MfaVerificationType.Otp) instead.",

reason:
the display to developers when using in their ids will show in one line.

Same can be done for:
(loginWithOTP)
(loginWithOOB)
(loginWithRecoveryCode)
(multifactorChallenge)

Copy link
Contributor Author

@pmathew92 pmathew92 Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is single line. It is being shown as two line here in the PR

message = "loginWithOTP is deprecated and will be removed in the next major version of the SDK. Use the APIs in the [com.auth0.android.authentication.mfa.MfaApiClient] class instead.",
Copy link
Contributor

@utkrishtsahu utkrishtsahu Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can use replaceWith so that
users get a warning and IDE help to actually migrate.
e.g
replaceWith = ReplaceWith(
expression = "mfaClient(mfaToken).verify(MfaVerificationType.Otp(otp))",
imports = ["com.auth0.android.authentication.mfa.MfaVerificationType"]

Same for others

Copy link
Contributor Author

@pmathew92 pmathew92 Mar 6, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The advantage of using replaceWith is that this will automatically let the IDE make the suggested changes. Two caveat in this scenario is

  1. we have added new error types for all these APIs instead of the exisiting AuthenticationException.
  2. We need to define the exact API client name for replacing the existing API. Since the new flow requires us to create an instance of mfaApiClient which the user might not have created or would have created with a different name. Both case can cause errors and might confuse users.
    Hence I thought to keep it simple

level = DeprecationLevel.WARNING
)
public fun loginWithOTP(mfaToken: String, otp: String): AuthenticationRequest {
val parameters = ParameterBuilder.newBuilder()
.setGrantType(ParameterBuilder.GRANT_TYPE_MFA_OTP)
Expand Down Expand Up @@ -409,6 +414,10 @@ public class AuthenticationAPIClient @VisibleForTesting(otherwise = VisibleForTe
* This is usually an OTP-like code delivered as part of the challenge message.
* @return a request to configure and start that will yield [Credentials]
*/
@Deprecated(
message = "loginWithOOB is deprecated and will be removed in the next major version of the SDK. Use the APIs in the [com.auth0.android.authentication.mfa.MfaApiClient] class instead.",
level = DeprecationLevel.WARNING
)
public fun loginWithOOB(
mfaToken: String,
oobCode: String,
Expand Down Expand Up @@ -445,6 +454,10 @@ public class AuthenticationAPIClient @VisibleForTesting(otherwise = VisibleForTe
* @return a request to configure and start that will yield [Credentials]. It might also include a [recoveryCode] field,
* which your application must display to the end-user to be stored securely for future use.
*/
@Deprecated(
message = "loginWithRecoveryCode is deprecated and will be removed in the next major version of the SDK. Use the APIs in the [com.auth0.android.authentication.mfa.MfaApiClient] class instead.",
level = DeprecationLevel.WARNING
)
public fun loginWithRecoveryCode(
mfaToken: String,
recoveryCode: String
Expand Down Expand Up @@ -478,6 +491,10 @@ public class AuthenticationAPIClient @VisibleForTesting(otherwise = VisibleForTe
* @param authenticatorId The ID of the authenticator to challenge.
* @return a request to configure and start that will yield [Challenge]
*/
@Deprecated(
message = "multifactorChallenge is deprecated and will be removed in the next major version of the SDK. Use the APIs in the [com.auth0.android.authentication.mfa.MfaApiClient] class instead.",
level = DeprecationLevel.WARNING
)
public fun multifactorChallenge(
mfaToken: String,
challengeType: String? = null,
Expand Down