Release v1.2.0

clerk-android-api 1.2.0, clerk-android-ui 1.2.0 and clerk-android-telemetry 1.1.0.

Requires compileSdk 37 (clerk-android-ui)

clerk-android-ui now depends on androidx.lifecycle 2.11.0 (#1077). Its lifecycle-runtime-compose, lifecycle-viewmodel-compose and lifecycle-viewmodel-navigation3 artifacts declare minCompileSdk=37, so apps must compile against API 37. targetSdk and minSdk (24) are unchanged. clerk-android-api only needs compileSdk 34.

Breaking changes

• Step composables are internal (#1024). These public composables always crashed outside their host view, and are now internal: AuthStartView, SignInFactorOneView, SignInFactorTwoView, SignInFactorAlternativeMethodsView, SignInFactorTwoBackupCodeView, SignInClientTrustView, SignInFactorCodeView, SignInFactorOneEmailLinkView, SignInGetHelpView, SignInFactorOnePasskeyView, SignInFactorTwoPasskeyView, SignInFactorOneForgotPasswordView, SignInSetNewPasswordView, SignInFactorOnePasswordView, SignUpCodeView, SignUpCollectFieldView, SignUpCompleteProfileView, SignUpEmailLinkView, UserProfileDetailView, UserProfileVerifyView. Use AuthView / UserProfileView instead.
• Nullable fields (#1064, #1059). An enterprise connection's logo, and role and permission descriptions, are now nullable because the server can omit them.
• AuthView has a new parameter (#1097). Code compiled against 1.1.x must be recompiled.

Deprecations

• ClerkLog and OrganizationApi (#1024), and the old SignIn / SignUp auth entry points in favour of Clerk.auth (#1039). They still work in 1.2.0.

New

• Restore Credentials in AuthView (#1097): AuthView(enableRestoreCredentials = true), opt-in, for Google Play's sign-in restoration requirement. It tries a silent restore on the first launch after install/restore and creates a restore key after sign-in. It needs passkeys enabled as a first factor.
• Clerk.auth facade covers everything the prebuilt UI needs (#1035), typed Strategy (#1025), sealed OAuthResult.Outcome (#1030), stable test tags on the prebuilt views (#1040), framework device token compare-and-set (#964).

Fixes

• OAuth/SSO: one RedirectCoordinator for all redirect flows, with callback state checks against forged deep links (#1033). Transfer to sign-up on a bare OAuth callback (#1078). Fixes for recreated activities, cancellation and log redaction (#1008, #1009, #1044).
• Setup-MFA: backup codes are shown before the next session task (#1080), survive rotation (#1084), and the step is tied to its session (#1087).
• ClerkResult functions no longer throw (#1031). Unknown server enum values decode to UNKNOWN (#1027), and 3xx responses with a body return a failure (#1028).
• Reliability and performance:
  • Session token refresh pauses in the background (#1018), and the initial refresh no longer overwrites a newer client (#1020).
  • Keystore setup and cache hydration moved off the initialize caller thread (#1013), and the decrypted device token is cached (#1014).
  • Client state uses a single ordered store (#1017), and prebuilt views rebuild when Clerk finishes loading (#1068).
• UI: Delete account follows deleteSelfEnabled (#1058), the email code screen is kept when email link is supported (#1043), and the top bar trailing action is aligned (#1076).

Telemetry 1.1.0

A plain Android library without Ktor (#1019). The instance type's wire name is now read correctly (#1060).

All changes

What's Changed

• fix(sso): finish the bridge activity when it's recreated mid-completion by @mikepitre in #1008
• fix(ui): keep the account root when clearing the user profile back stack by @mikepitre in #1010
• fix(passkeys): strip only a leading www. from the fallback rpId by @mikepitre in #1007
• feat(api): add framework device token compare-and-set by @mikepitre in #964
• fix(hosted-auth): refresh the client before retrying a signed_out create by @mikepitre in #1011
• chore: drop comments that restate or misdescribe code by @mikepitre in #1037
• fix(signout): propagate cancellation and always finish local cleanup by @mikepitre in #1009
• fix(sso): redact callback URI in no-pending-auth warning by @dominic-clerk in #1044
• fix(ui): keep the email code screen when email link is supported by @mikepitre in #1043
• docs: add a comment rule to AGENTS.md by @mikepitre in #1047
• fix(api): stop the two auth API layers drifting on enterprise sign-up, sendCode and error events by @swolfand in #1026
• refactor(api): route both auth API layers through one implementation per operation by @swolfand in #1034
• feat(api): fill the Clerk.auth gaps the prebuilt UI needs by @swolfand in #1035
• refactor(ui): move the prebuilt UI onto the Clerk.auth facade by @swolfand in #1038
• refactor(api): deprecate the old SignIn/SignUp auth entry points by @swolfand in #1039
• fix(api): return a failure for 3xx responses with a body by @mikepitre in #1028
• fix(user): apply the fetched client in User.reload and return the fresh user by @mikepitre in #1029
• ci: run build and unit test workflows on PRs into any branch by @swolfand in #1050
• fix(restore-credentials): rethrow cancellation instead of reporting a failure by @swolfand in #1012
• fix(ui): persist auth-start identifier edits with apply() instead of commit() by @swolfand in #1015
• fix(api): pause the session token refresh loop while the app is backgrounded by @swolfand in #1018
• fix(api): don't let initial refresh overwrite a newer adopted client by @swolfand in #1020
• test(api): make api and telemetry tests fail when the behaviour they cover breaks by @swolfand in #1049
• test(ui): make ui tests fail when the behaviour they cover breaks by @swolfand in #1051
• ci: run the Trailblaze trail in the release workflow and publish only if it passes by @mikepitre in #1054
• feat(api): add typed Strategy and migrate strategy comparisons by @swolfand in #1025
• refactor(api): remove unused device attestation, reflection helpers, and dependencies by @swolfand in #1016
• fix(api): decode unknown server enum values to UNKNOWN everywhere by @swolfand in #1027
• refactor(telemetry): make telemetry a plain Android library and drop Ktor by @swolfand in #1019
• feat(api): add sealed OAuthResult.Outcome and drop UI force-unwraps by @swolfand in #1030
• fix(telemetry): read the instance type's wire name by encoding it by @swolfand in #1060
• ci: enforce formatting, lint, type-resolved detekt and telemetry tests; gate releases on checks by @swolfand in #1021
• build: check the public ABI against checked-in dumps by @swolfand in #1022
• build: enable explicit API mode for api, ui and telemetry by @swolfand in #1023
• fix(biometric-credentials): revoke current credential without a usable key by @mikepitre in #1074
• fix(deps): update kotlin monorepo to v2.4.21 by @renovate[bot] in #1073
• chore(deps): update dependency org.jetbrains.kotlin.jvm to v2.4.21 by @renovate[bot] in #1072
• chore(deps): update gradle to v9.8.1 by @renovate[bot] in #1067
• chore(deps): update dependency org.jetbrains.kotlinx.binary-compatibility-validator to v0.18.2 by @renovate[bot] in #1061
• fix(deps): update asm to v9.10.1 by @renovate[bot] in #1062
• fix(deps): update dependency com.slack.lint.compose:compose-lint-checks to v1.6.1 by @renovate[bot] in #1065
• fix(deps): update dependency com.googlecode.libphonenumber:libphonenumber to v9.0.41 by @renovate[bot] in #1066
• fix(api)!: decode null role and permission descriptions by @seanperez29 in #1059
• fix(api)!: decode enterprise connections without a logo by @seanperez29 in #1064
• fix(api): keep the session's organization when activating a native email-link sign-in by @seanperez29 in #1063
• fix(ui): rebuild prebuilt views when Clerk finishes loading by @mikepitre in #1068
• fix(session): treat signed_out as a session that can no longer issue tokens by @seanperez29 in #1070
• feat(ui): add stable test tags to the prebuilt Compose views by @mikepitre in #1040
• fix(ui): show Delete account based on the user's deleteSelfEnabled flag by @seanperez29 in #1058
• fix(api): decode credit ledger created_at from an RFC 3339 string by @seanperez29 in #1055
• fix(api): cache the decrypted device token in memory by @swolfand in #1014
• chore: add fix-review skill for acting on the biweekly codebase review by @swolfand in #1056
• test(e2e): bring the e2e app to parity with the iOS e2e harness by @swolfand in #1057
• chore(deps): update dependency com.diffplug.spotless to v8.10.4 by @renovate[bot] in #1075
• refactor(ui): scope prebuilt UI ViewModels to their component and nav entry by @swolfand in #1032
• refactor(api): move client state into a single-writer ordered state store by @swolfand in #1017
• refactor(ui): route the prebuilt auth flow through one pure function by @swolfand in #1036
• fix(api): stop ClerkResult functions from throwing by @swolfand in #1031
• fix(api): move keystore setup and cache hydration off the initialize caller thread by @swolfand in #1013
• fix(deps): update asm to v9.11 by @renovate[bot] in #1085
• fix(ui): keep backup codes across device rotation by @claude[bot] in #1084
• fix(ui): show the backup codes before the setup-MFA session task completes by @mikepitre in #1080
• fix(deps): update dependency androidx.lifecycle:lifecycle-viewmodel-navigation3 to v2.11.0 by @renovate[bot] in #1077
• fix(ui): align top bar trailing action with content padding by @swolfand in #1076
• fix(sso): transfer to sign-up on a bare OAuth callback by @swolfand in #1078
• test(e2e): configure the e2e host from verify launch extras by @mikepitre in #1041
• docs: tell agents to keep translations in step with English text by @mikepitre in #1086
• fix(ui): tie the setup-MFA step to the session it belongs to by @mikepitre in #1087
• feat(verify): add the end-to-end test package and the verify-clerk-android skill by @mikepitre in #1046
• ci: run the end-to-end tests in the release workflow, and remove the Trailblaze suite by @mikepitre in #1052
• feat(verify): borrow an emulator on a CI runner when the machine cannot run one by @mikepitre in #1069
• ci: publish the evidence a borrowed-device session hands off by @mikepitre in #1079
• feat(verify): post the evidence that shows the change, before and after by @mikepitre in #1088
• fix(verify): publish for a session that started on a commit of the base branch by @mikepitre in #1089
• refactor(verify): rename specs/golden to specs/features by @mikepitre in #1090
• test(verify): add the two unit tests and three e2e tests that clerk-ios has by @mikepitre in #1091
• refactor(api): one RedirectCoordinator for all redirect flows, with callback state checks by @swolfand in #1033
• ci: bump clerk-android in @clerk/expo-native-components after the Expo package split by @mikepitre in #971
• test(verify): small fixes to the e2e tests and their config by @mikepitre in #1092
• docs(verify): bring the skill text clerk-ios has to the Android skill by @mikepitre in #1093
• feat(verify): build uncommitted app changes on a remote session by @mikepitre in #1094
• fix(ui): hide step composables that crash outside their host view; deprecate accidental public API by @swolfand in #1024
• perf(verify): install a stored e2e APK in a remote session instead of building it by @mikepitre in #1095
• chore(deps): update dependency ubuntu to v26 by @renovate[bot] in #1098
• chore(verify): link the verify skill where Codex loads skills by @mikepitre in #1101
• feat(ui): opt-in Restore Credentials in AuthView by @swolfand in #1097
• chore(release): bump clerk-android to 1.2.0 and telemetry to 1.1.0 by @swolfand in #1104

New Contributors

• @dominic-clerk made their first contribution in #1044

Full Changelog: v1.1.11...v1.2.0