diff --git a/features/authentication/email.mdx b/features/authentication/email.mdx index 9f4ff4c3..f9a4775d 100644 --- a/features/authentication/email.mdx +++ b/features/authentication/email.mdx @@ -113,7 +113,7 @@ After receiving the verification token, users complete OTP authentication flow w - `expirationSeconds`: optional validity window (defaults to 15 minutes) - `invalidateExisting`: optional boolean to invalidate previous login sessions -Upgrading a legacy OTP integration, SDK Browser/Server/React from before 6.0, or Wallet Kit/Core from before 2.0? Follow the [OTP migration guide](/features/authentication/otp-migration-guide) to update activity versions, encrypted bundles, client signatures, and policies. +Upgrading a legacy OTP integration, SDK Browser/Server/React from before 6.0, SDK React Native from before 1.5.21, or Wallet Kit/Core from before 2.0? Follow the [OTP migration guide](/features/authentication/otp-migration-guide) to update activity versions, encrypted bundles, client signatures, and policies. ![auth otp email](/images/authentication/img/auth_otp_email.png) diff --git a/features/authentication/otp-migration-guide.mdx b/features/authentication/otp-migration-guide.mdx index 258c6a5e..c8354f45 100644 --- a/features/authentication/otp-migration-guide.mdx +++ b/features/authentication/otp-migration-guide.mdx @@ -4,7 +4,7 @@ sidebarTitle: "OTP migration guide" description: "How to migrate to Turnkey's new security-upgraded OTP authentication flows." --- -Turnkey's current email and SMS OTP flows encrypt each OTP attempt before it leaves the client. The client encrypts the code and a session public key to a Turnkey enclave target key. After successful verification, the resulting verification token is bound to the client public key, so an application server cannot read the OTP or use the token to authenticate without the matching client private key. +Turnkey's current email and SMS OTP flows encrypt each OTP attempt before it leaves the client. The client encrypts the code and a session public key to a Turnkey enclave target key. After successful verification, the resulting verification token is bound to the client public key, so an application server cannot read the OTP or use the token to log in or sign up without the matching client private key. This guide is for integrations that use legacy OTP activities or SDK methods that send `otpCode` in plaintext. New integrations should use the current flow documented in [Email auth & recovery](/features/authentication/email) and [SMS authentication](/features/authentication/sms). @@ -53,6 +53,7 @@ The encrypted flow was introduced in the following releases. Use these versions | `@turnkey/sdk-react` | [`6.0.0`](https://github.com/tkhq/sdk/blob/main/packages/sdk-react/CHANGELOG.md#600) | | `@turnkey/sdk-browser` | [`6.0.0`](https://github.com/tkhq/sdk/blob/main/packages/sdk-browser/CHANGELOG.md#600) | | `@turnkey/sdk-server` | [`6.0.0`](https://github.com/tkhq/sdk/blob/main/packages/sdk-server/CHANGELOG.md#600) | +| `@turnkey/sdk-react-native` | [`1.5.21`](https://github.com/tkhq/sdk/blob/main/packages/sdk-react-native/CHANGELOG.md#1521) | | `@turnkey/react-wallet-kit` | [`2.0.0`](https://github.com/tkhq/sdk/blob/main/packages/react-wallet-kit/CHANGELOG.md#200) | | `@turnkey/react-native-wallet-kit` | [`2.0.0`](https://github.com/tkhq/sdk/blob/main/packages/react-native-wallet-kit/CHANGELOG.md#200) | | `@turnkey/core` | [`2.0.0`](https://github.com/tkhq/sdk/blob/main/packages/core/CHANGELOG.md#200) | @@ -134,6 +135,8 @@ Choose the section below that matches your integration. + Legacy `@turnkey/sdk-react-native` integrations also follow this section. That package re-exports the low-level `@turnkey/http` client and does not automate OTP bundle creation or client signatures. For new React Native integrations, use [React Native Wallet Kit](/solutions/embedded-wallets/integration-guide/react-native/overview). + `sendOtp` and `initOtp` now return an encryption target bundle. Persist it only for the lifetime of the OTP attempt and return it to the client that will verify the code. ```ts diff --git a/features/authentication/sms.mdx b/features/authentication/sms.mdx index 14ac47a2..d9bef9f4 100644 --- a/features/authentication/sms.mdx +++ b/features/authentication/sms.mdx @@ -38,7 +38,7 @@ SMS authentication uses three activities: 2. `VERIFY_OTP_V2` — securely verifies the code and returns a signed verificationToken JWT 3. `OTP_LOGIN_V2` — validates the verificationToken and returns a session (signed with the verification token key) -Upgrading a legacy OTP integration, SDK Browser/Server/React from before 6.0, or Wallet Kit/Core from before 2.0? Follow the [OTP migration guide](/features/authentication/otp-migration-guide) to update activity versions, encrypted bundles, client signatures, and policies. +Upgrading a legacy OTP integration, SDK Browser/Server/React from before 6.0, SDK React Native from before 1.5.21, or Wallet Kit/Core from before 2.0? Follow the [OTP migration guide](/features/authentication/otp-migration-guide) to update activity versions, encrypted bundles, client signatures, and policies. ## Implementation