SDK-6103 Added support for My Account API. #847

utkrishtsahu · 2025-07-21T03:47:16Z

This PR introduces new sets of API for the MyAccount feature .

Checklist
I have read the Auth0 general contribution guidelines

All existing and new tests complete without errors

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

auth0/src/main/java/com/auth0/android/result/AuthenticationMethod.kt

auth0/src/main/java/com/auth0/android/result/EnrollmentChallenge.kt

+    internal class Deserializer : JsonDeserializer<EnrollmentChallenge> {
+        override fun deserialize(
+            json: JsonElement,
+            typeOfT: Type,
+            context: JsonDeserializationContext
+        ): EnrollmentChallenge? {
+            val jsonObject = json.asJsonObject
+            val targetClass = when {
+                jsonObject.has("barcode_uri") -> TotpEnrollmentChallenge::class.java
+                jsonObject.has("recovery_code") -> RecoveryCodeEnrollmentChallenge::class.java
+                jsonObject.has("authn_params_public_key") -> PasskeyEnrollmentChallenge::class.java
+                else -> MfaEnrollmentChallenge::class.java
+            }
+            return context.deserialize(jsonObject, targetClass)
+        }
+    }


pmathew92 · 2025-07-21T05:19:35Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

- * You can use the refresh token to get an access token for the My Account API. Refer to [com.auth0.android.authentication.storage.CredentialsManager.getApiCredentials]
- *  , or alternatively [com.auth0.android.authentication.AuthenticationAPIClient.renewAuth] if you are not using CredentialsManager.
+ * You can use a refresh token to get an access token for the My Account API.
+ * Refer to `CredentialsManager#getApiCredentials` or `AuthenticationAPIClient#renewAuth`.


Why was the comment changed ? Ensure the comments convey as much detail as possible including samples wherever applicable

pmathew92 · 2025-07-21T05:20:23Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

 *
 * ## Usage
 * ```kotlin
- * val auth0 = Auth0.getInstance("YOUR_CLIENT_ID", "YOUR_DOMAIN")
- * val client = MyAccountAPIClient(auth0,accessToken)
+ * val auth0 = Auth0("YOUR_CLIENT_ID", "YOUR_DOMAIN")


val auth0 = Auth0.getInstance("YOUR_CLIENT_ID", "YOUR_DOMAIN") is the correct way to access an Auth0 instance . Please correct in the comment

pmathew92 · 2025-07-22T10:53:28Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+    public fun updateAuthenticationMethodById(
+        authenticationMethodId: String,
+        preferredAuthenticationMethod: String,
+        authenticationMethodName: String


These are optional parameters

Please make them as optional .Check with @NandanPrabhu

…nd modifying Email, Phone, and TOTP Verification verifyOtp(...)

pmathew92 · 2025-07-28T11:17:09Z

auth0/src/main/java/com/auth0/android/result/EnrollmentChallenge.kt

+                jsonObject.has("barcode_uri") -> TotpEnrollmentChallenge::class.java
+                jsonObject.has("recovery_code") -> RecoveryCodeEnrollmentChallenge::class.java
+                jsonObject.has("authn_params_public_key") -> PasskeyEnrollmentChallenge::class.java
+                else -> MfaEnrollmentChallenge::class.java


Does these 4 options cover all the response scenarios as per the OAS ?

pmathew92 · 2025-07-28T11:22:06Z

auth0/src/main/java/com/auth0/android/result/EnrollmentChallenge.kt

+    public val recoveryCode: String
+) : EnrollmentChallenge(id, authSession)
+
+public data class PublicKeyCredentialCreationOptions(


This seems to be a duplicate of AuthnParamsPublicKey data class in the PasskeyRegistrationChallenge.kt file

pmathew92 · 2025-07-28T11:36:13Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+    public val identityUserId: String?
+) : EnrollmentPayload("passkey")
+
+public data class WebAuthnPlatformEnrollmentPayload(


This can be a normal class ?

public class WebAuthnPlatformEnrollmentPayload() : EnrollmentPayload("webauthn-roaming")

This way you don't have to add an empty placeholder for the data class

pmathew92 · 2025-07-28T11:36:26Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class WebAuthnRoamingEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("webauthn-roaming")


Same as above

pmathew92 · 2025-07-28T11:36:33Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class TotpEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("totp")


pmathew92 · 2025-07-28T11:36:42Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+) : EnrollmentPayload("totp")
+
+public data class PushNotificationEnrollmentPayload(
+    private val placeholder: String? = null


pmathew92 · 2025-07-28T11:36:46Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+) : EnrollmentPayload("push-notification")
+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null


pmathew92 · 2025-07-28T11:43:16Z

auth0/src/main/java/com/auth0/android/result/PasskeyAuthenticationMethod.kt

The AuthenticationMethod data class has some mandatory property like usage which the passkeys response might not send . Please cross check them and test this to avoid run time crashes

pmathew92 · 2025-07-28T11:44:03Z

auth0/src/main/java/com/auth0/android/result/PasskeyEnrollmentChallenge.kt

-)
+    public val authenticationMethodId: String,
+    public val authSession: String,
+    public val authParamsPublicKey: AuthnParamsPublicKey


why are the serialized names removed ?

pmathew92 · 2025-07-28T11:46:53Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

-import com.auth0.android.request.JsonAdapter
-import com.auth0.android.request.PublicKeyCredentials
-import com.auth0.android.request.Request
+import com.auth0.android.request.*


Please configure your IDE to have specific imports instead of generic one

pmathew92 · 2025-07-28T11:49:27Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     */
+    public fun updateAuthenticationMethodById(
+        authenticationMethodId: String,
+        preferredAuthenticationMethod: String,


lets limit the preferredAuthenticationMethod type to the accepted values of sms and voice . Lets use an enum type here with string default value

pmathew92 · 2025-07-28T11:50:40Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * val auth0 = Auth0.getInstance("YOUR_CLIENT_ID", "YOUR_DOMAIN")
+     * val apiClient = MyAccountAPIClient(auth0, accessToken)
+     *
+     * apiClient.getFactors()


Format the code samples as these are client facing

pmathew92 · 2025-07-28T11:51:30Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * val apiClient = MyAccountAPIClient(auth0, accessToken)
+     *
+     * apiClient.enrollPhone("+11234567890", "sms")
+     *        .start(object : Callback<EnrollmentChallenge, MyAccountException> {


Format the code samples

pmathew92 · 2025-07-28T11:52:14Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * @param preferredMethod The preferred method for this factor ("sms" or "voice").
+     * @return a request that will yield an enrollment challenge.
+     */
+    public fun enrollPhone(phoneNumber: String, preferredMethod: String): Request<EnrollmentChallenge, MyAccountException> {


As discussed above ,lets have the preferred method as an enum type

Copilot

Pull Request Overview

This PR introduces comprehensive support for the My Account API, adding new functionality for managing authentication methods and factors beyond the existing passkey support.

Key changes include:

Addition of new authentication method management APIs (CRUD operations)
Support for enrolling various factor types (email, phone, TOTP, recovery codes, push notifications)
Introduction of new data models to support different authentication method types
Consolidation of existing passkey-specific classes into more general authentication method structures

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`MyAccountAPIClientTest.kt`	Updated test suite to include comprehensive tests for new API endpoints and removed redundant passkey-specific tests
`MyAccountAPIClient.kt`	Added new API methods for authentication method management and factor enrollment
`AuthenticationMethod.kt`	New unified data model for all authentication method types
`EnrollmentChallenge.kt`	New sealed class hierarchy for different enrollment challenge types
`EnrollmentPayload.kt`	New sealed class for various enrollment request payloads
`Factors.kt`	New data model for factor listings
`Factor.kt`	New data model representing individual factors
`ErrorResponse.kt`	New standardized error response model
`VerificationPayload.kt`	New data model for verification requests
`PasskeyAuthenticationMethod.kt`	Converted to type alias pointing to general AuthenticationMethod
`PasskeyEnrollmentChallenge.kt`	Simplified to remove serialization annotations

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-08-19T05:22:09Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("recovery-code")


Using placeholder parameters in data classes is not a good practice. Consider using object declarations for payload types that don't need additional properties, or remove these placeholder fields entirely.

Suggested change

) : EnrollmentPayload("recovery-code")

public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")

public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")

public object TotpEnrollmentPayload : EnrollmentPayload("totp")

public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")

public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

Copilot · 2025-08-19T05:22:09Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("recovery-code")


Using placeholder parameters in data classes is not a good practice. Consider using object declarations for payload types that don't need additional properties, or remove these placeholder fields entirely.

Suggested change

) : EnrollmentPayload("recovery-code")

public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")

public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")

public object TotpEnrollmentPayload : EnrollmentPayload("totp")

public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")

public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

Copilot · 2025-08-19T05:22:09Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("recovery-code")


Using placeholder parameters in data classes is not a good practice. Consider using object declarations for payload types that don't need additional properties, or remove these placeholder fields entirely.

Suggested change

) : EnrollmentPayload("recovery-code")

public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")

public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")

public object TotpEnrollmentPayload : EnrollmentPayload("totp")

public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")

public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

Copilot · 2025-08-19T05:22:09Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("recovery-code")


Using placeholder parameters in data classes is not a good practice. Consider using object declarations for payload types that don't need additional properties, or remove these placeholder fields entirely.

Suggested change

) : EnrollmentPayload("recovery-code")

public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")

public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")

public object TotpEnrollmentPayload : EnrollmentPayload("totp")

public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")

public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

Copilot · 2025-08-19T05:22:10Z

auth0/src/main/java/com/auth0/android/result/EnrollmentPayload.kt

+
+public data class RecoveryCodeEnrollmentPayload(
+    private val placeholder: String? = null
+) : EnrollmentPayload("recovery-code")


Using placeholder parameters in data classes is not a good practice. Consider using object declarations for payload types that don't need additional properties, or remove these placeholder fields entirely.

Suggested change

) : EnrollmentPayload("recovery-code")

public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")

public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")

public object TotpEnrollmentPayload : EnrollmentPayload("totp")

public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")

public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

Copilot · 2025-08-19T05:22:10Z

auth0/src/main/java/com/auth0/android/result/Factor.kt

+package com.auth0.android.result
+
+import com.google.gson.annotations.SerializedName
+


The Factor class lacks documentation. Public data classes should have KDoc comments explaining their purpose and properties.

Suggested change

/**

* Represents a multi-factor authentication factor.

*

* @property type The type of factor (e.g., "totp", "sms", etc.).

* @property usage The usages supported by this factor (e.g., "authentication", "recovery"). May be null.

*/

NandanPrabhu · 2025-08-19T07:10:55Z

auth0/src/main/java/com/auth0/android/result/EnrollmentChallenge.kt

+    @SerializedName("barcode_uri")
+    public val barcodeUri: String,
+    @SerializedName("manual_input_code")
+    public val manualInputCode: String


manualInputCode must be optional.we dont get it incase of push notification factor

NandanPrabhu · 2025-08-19T07:13:40Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     */
+    public fun updateAuthenticationMethodById(
+        authenticationMethodId: String,
+        authenticationMethodName: String,


name and preferredAuthenticationMethod can be updated together or one at a time. So we need to make both of them optional

pmathew92 · 2025-08-19T09:21:53Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * ```
+     *
+     */
+    public fun getAuthenticationMethods(): Request<AuthenticationMethods, MyAccountException> {


@NandanPrabhu @utkrishtsahu Would it be more Dx friendly if we return List here ? With this now the user has to result.list[index] to access an AuthenticationMethod . Just returning the list will be easier I think. Returning a list will also be easy when we add support for Pagination and would be easier. Let me know your thoughts

pmathew92 · 2025-08-19T09:26:50Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+            url.toString(),
+            GsonAdapter(AuthenticationMethods::class.java)
+        )
+            .addHeader(AUTHORIZATION_KEY, "Bearer $accessToken")


This approach will change once DPoP support is added to MyAccountAPIs. Just an heads up on the same

pmathew92 · 2025-08-19T09:31:34Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * val apiClient = MyAccountAPIClient(auth0, accessToken)
+     *
+     *
+     * apiClient.deleteAuthenticationMethod(authenticationMethodId, )


nit: It should be apiClient.deleteAuthenticationMethod(authenticationMethodId )

pmathew92 · 2025-08-19T09:36:57Z

auth0/src/main/java/com/auth0/android/myaccount/MyAccountAPIClient.kt

+     * ```
+     * @return A request to get the list of available factors.
+     */
+    public fun getFactors(): Request<Factors, MyAccountException> {


Return type can be List<Factor> instead of Factors as discussed above

pmathew92 · 2025-08-19T09:41:14Z

auth0/src/test/java/com/auth0/android/myaccount/MyAccountAPIClientTest.kt

@@ -56,262 +52,177 @@ public class MyAccountAPIClientTest {
        assertThat(request.path, Matchers.equalTo("/me/v1/authentication-methods"))
    }

-    @Test


why are these cases removed ?

Added support for My Account API

c8243e3

utkrishtsahu requested a review from a team as a code owner July 21, 2025 03:47

github-advanced-security bot found potential problems Jul 21, 2025

View reviewed changes

pmathew92 reviewed Jul 21, 2025

View reviewed changes

utkrishtsahu added 2 commits July 22, 2025 10:19

Refactor the code with SDK-6075's changes

58ebd47

Added few more payloads

c0703ad

pmathew92 reviewed Jul 22, 2025

View reviewed changes

utkrishtsahu added 2 commits July 24, 2025 10:48

adding Push Notification verify(...) and Recovery Code Verification a…

a702900

…nd modifying Email, Phone, and TOTP Verification verifyOtp(...)

adding KDoc for methods with Usage

13da6ba

pmathew92 reviewed Jul 28, 2025

View reviewed changes

pmathew92 mentioned this pull request Aug 12, 2025

Added support for My Account API [DO NOT MERGE] #842

Closed

6 tasks

utkrishtsahu added 2 commits August 19, 2025 10:43

Added UT test caes and changes excluding WebAuthn

c42e67f

Refactored code removed comments

eddddc0

pmathew92 requested a review from Copilot August 19, 2025 05:20

Copilot AI reviewed Aug 19, 2025

View reviewed changes

NandanPrabhu reviewed Aug 19, 2025

View reviewed changes

pmathew92 reviewed Aug 19, 2025

View reviewed changes

-) : EnrollmentPayload("recovery-code")
+public object WebAuthnPlatformEnrollmentPayload : EnrollmentPayload("webauthn-platform")
+public object WebAuthnRoamingEnrollmentPayload : EnrollmentPayload("webauthn-roaming")
+public object TotpEnrollmentPayload : EnrollmentPayload("totp")
+public object PushNotificationEnrollmentPayload : EnrollmentPayload("push-notification")
+public object RecoveryCodeEnrollmentPayload : EnrollmentPayload("recovery-code")

		package com.auth0.android.result

		import com.google.gson.annotations.SerializedName

+/**
+ * Represents a multi-factor authentication factor.
+ *
+ * @property type The type of factor (e.g., "totp", "sms", etc.).
+ * @property usage The usages supported by this factor (e.g., "authentication", "recovery"). May be null.
+ */

SDK-6103 Added support for My Account API. #847

Are you sure you want to change the base?

SDK-6103 Added support for My Account API. #847

Uh oh!

Conversation

utkrishtsahu commented Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

Check notice

Copilot Autofix

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmathew92 Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Aug 19, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmathew92 Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

pmathew92 Jul 28, 2025 •

edited

Loading

pmathew92 Aug 19, 2025 •

edited

Loading