Mobile SDK

We are facing an issue while logging in to our custom Android application built using the Salesforce Mobile SDK. When users attempt to log in, Salesforce displays the "Verify Your Identity" page, asking them to authenticate using a passkey. 

1. App Type: Custom Android application (Salesforce Mobile SDK)

2. Login URL: https://login.salesforce.com

3. OAuth authentication is successful, but users are prompted with Verify Your Identity. 

The page asks users to "Use any passkey on your account." 

4. After successful authentication, our application sometimes shows a blank screen instead of completing the login.  

Any guidance would be greatly appreciated. 

I'm not entirely sure if this is the right place to ask, but I have a couple of questions regarding the login functionality and Built-in Authenticator behavior when using the Salesforce Mobile SDK. 

1. Connection/Endpoint Memory Feature in Mobile SDK

In the Salesforce Mobile App, when a user logs in with their credentials and later logs out, the organization's URL (presumably the My Domain URL) is automatically added and saved to the "Choose Connection" screen. Even after restarting the app, this endpoint remains selected by default unless manually changed.

Does the Salesforce Mobile SDK provide a similar feature to add logged-in org URL to the "Change Server" screen and remember the connection/endpoint? 

2. Built-in Authenticator (Passkeys) and MFA Login Behavior

Suppose a user has MFA enabled. They log into an org via a custom Salesforce Mobile SDK app and create a Built-in Authenticator (Passkey) during the login process. Later, when the same user attempts to log into the same org from a desktop browser using the previously created passkey, a QR code is displayed on the desktop screen. The user must scan this QR code with their mobile device to complete the login.

Questions:

• Is this cross-device login flow (scanning a QR code on the desktop with the mobile device) the expected behavior according to the Salesforce Mobile SDK specifications?
• Are there any official documentation or reference materials detailing this specific flow (creating a built-in authenticator via a Mobile SDK app and utilizing it for cross-device desktop logins)?

Any insights, official references, or guidance would be greatly appreciated.

Thank you.

Clarification needed：launchMode for LoginActivity in Advanced Authentication (Android) 

I am currently implementing Advanced Authentication for our Android app using the Salesforce Mobile SDK 13.2.1, and I noticed a discrepancy between the official documentation and the SDK's source code regarding the launchMode configuration. 

According to the Advanced Authentication documentation（

）, the required android:launchMode for LoginActivity should be singleInstance. 

However, looking at the LoginActivity in the Salesforce Mobile SDK source code, the launchMode is currently set to singleTask. 

To strictly follow the documentation and set the launchMode to singleInstance in my application's AndroidManifest.xml, I have to explicitly define tools:replace="android:launchMode". This adds an extra step that isn't mentioned in the sample code provided in the article. 

Could you please clarify which approach is the correct/recommended one? 

・Option A: Leave it as singleTask (to align with the SDK's default behavior). 

・Option B: Override it to singleInstance using tools:replace="android:launchMode" (as suggested in the documentation). 

Thank you.

I am currently working on an iOS app using the Salesforce Mobile SDK and am in the process of supporting MFA. I've encountered an issue where an error occurs during the built-in authenticator registration process. 

I'm hoping someone might have some insights or workarounds for this. 

Environment & Prerequisites 

• SDK Version: Salesforce Mobile SDK 13.2.1 (iOS) 

• Platform: iOS 

• Login Method: Using the "Login For Admin" feature 

• Org Settings: 

• In "Identity Verification", [Let users verify their identity with a built-in authenticator such as Touch ID or Windows Hello] is Enabled. 

• MFA is required for the user via either of the following: 

Assigned a Permission Set with Multi-Factor Authentication for User Interface Logins enabled. 

Or, Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org is Enabled in the Identity Verification settings. 

Steps to Reproduce 

Log in to the configured org from the iOS app using "Login for Admin". 

After the initial authentication, a prompt appears to register a built-in authenticator (e.g., Touch ID / Face ID). 

Upon proceeding with the registration, an error is displayed and the registration cannot be completed. 

References & Context 

I am currently referring to the following Knowledge Article while investigating: 

When testing an Android app using the exact same Salesforce Mobile SDK 13.2.1 against the same org, I was able to successfully register the built-in authenticator without errors. 

Has anyone experienced a similar issue or found a workaround/implementation strategy to bypass this? Any advice would be greatly appreciated. 

Thank you.

Questions regarding the new username-first login flow (Mobile SDK 13.2.1) 

I have questions regarding the new login flow mentioned in the release notes. 

On the SalesforceMobileSDK 13.2.1 releases pages, there is the following note: 

"Note: Starting in June 2026, Salesforce prompts users to enter only their username as the first login step." 

(

) 

We have already upgraded our Android/iOS app to Salesforce Mobile SDK 13.2.1 and it is now June 2026, but we are still seeing the traditional login screen (where both username and password fields are displayed on the same page) instead of the new username-only UI. 

Could you please clarify the following points?

1.  SDK Support & Configuration: Is the username-first UI already fully supported and active in SDK 13.2.1? If it is already supported, is there any specific configuration, setting, or endpoint change required on our end to enable and display this new UI?
2. Expected User Flow: What is the expected behavior after a user enters their username? Does the app then redirect the user to their specific "My Domain" URL? Furthermore, if Advanced Authentication is configured for that org, will it automatically launch the browser (or Chrome Custom Tabs) at that point?
3. Org Type Restrictions: Is this new username-first login flow restricted to Production orgs only? Or is it possible to login to a Developer Edition org with this new username-first login UI? 
    
   Thank you.

Mobile SDK 13.2.1 is live to the world! 

Mobile SDK 13.2.1 is a minor patch release that features these changes. 

Phishing-Resistant MFA via Login for Admin

We added a **Login for Admin** menu item that forces advanced, browser-based authentication, which is a requirement for phishing-resistant multi-factor authentication (MFA). After forcing advanced authentication, the **Login for Admin** flow prompts the user to register or log in with a passkey. In Mobile SDK 13.2.0 and earlier, admin users can be blocked from logging in unless their org preconfigures advanced authentication in their **My Domain** settings and uses the My Domain URL to log in. See Using Advanced Authentication. 

Passkey and Identity Verification Support

We added passkey and identity verification support for enhanced authentication security. If configured to enable passkeys, the app automatically prompts the user to verify their identity and save a passkey when logging in. If not enabled by default, passkeys can be configured on the server-side. See Salesforce Help: Enable Passwordless Login with Passkeys. 

Android Support for Refresh Token Migration

We added Android support for refresh token migration, which now works on both platforms (Android and iOS). See Refresh Token Migration. 

GRAB THE LATEST HERE 

Android: GitHub, npm

iOS: GitHub, npm

Hybrid: npm

React Native: npm

Sfdx plugin: npm