Skip to content

Salesforce Mobile SDK 14.0.0

Latest
Latest

Choose a tag to compare

View all tags
@wmathurin wmathurin released this 05 Oct 23:25
· 95 commits to dev since this release
v14.0.0
1e37d80

What's New in Mobile SDK 14.0.0

Mobile SDK 14.0.0 is a major release that strengthens authentication security, modernizes the Android build toolchain, and updates core dependencies. This release also includes breaking changes to account management and REST client APIs.

In major releases, we remove items that were deprecated in earlier releases. Check compiler warnings after upgrading so that you can address deprecations before they become removals in a future release.

Grab the Latest Here

Secure Authentication Defaults

Mobile SDK 14.0.0 enables DPoP and Advanced Authentication by default for new logins.

DPoP Is Enabled by Default

Demonstrating Proof of Possession (DPoP) binds OAuth tokens to the device that obtained them. Mobile SDK creates and manages the per-user key material in Android Keystore, and adds DPoP proofs to supported authentication and API requests.

useDPoP now defaults to true, so new logins request DPoP-bound tokens without an app change. Existing users retain the token type of their current credentials until they authenticate again or the app explicitly migrates them.

Apps can temporarily opt out for new logins by setting useDPoP to false before starting authentication:

SalesforceSDKManager.getInstance().useDPoP = false

This setting affects new logins only. A credential that is already DPoP-bound continues to send DPoP proofs even if the global setting is later changed to false.

Release 264 (Winter '27) makes DPoP generally available and adds a per-app control that lets admins require it for a Connected App or External Client App. Enforcement is expected in 2027, initially for new External Client Apps, and may later expand to all apps. The control's availability does not itself enforce DPoP for all apps; the enforcement schedule and final scope are not yet confirmed.

The SDK opt-out controls client behavior only; it does not override a server-side DPoP requirement. If DPoP is required for an app, a client configured to use Bearer tokens will be unable to authenticate.

Migrate Already Logged-In Users to DPoP

Existing users who authenticated before the upgrade retain their Bearer sessions. To migrate an already logged-in user without changing the External Client App or Connected App, call the UserAccountManager.upgradeToDPoP() extension function. The API reauthenticates with the user's existing consumer key, redirect URI, and scopes, and replaces the credentials with DPoP-bound credentials. It works independently of the useDPoP setting. Salesforce can still present an approval screen during reauthentication.

UserAccountManager.getInstance().upgradeToDPoP(userAccount, { upgradedAccount ->
    // The account now has DPoP-bound credentials.
}, { error, errorDescription, throwable ->
    // Handle the migration failure.
})

DPoP in Hybrid Remote Apps

Hybrid remote apps can now rely on getMainSid() to get the correct session token for WebView cookie injection regardless of auth type. The server returns ui_sid in DPoP token responses; getMainSid() on UserAccount resolves ui_sid for DPoP sessions, parentSid for JWT Bearer, or accessToken for opaque Bearer.

Route specific requests to ui_sid Bearer. When a session is DPoP-bound and a UI-session token is available, apps can supply a path policy so that specific request paths use ui_sid Bearer authentication while everything else continues to use DPoP. By default no paths are opted in, so DPoP is used for all requests.

Advanced Authentication Is Enabled by Default

Advanced Authentication uses a browser-based OAuth session in a Custom Tab. In Mobile SDK 14.0.0, it is enabled by default for all login servers except Welcome, including login.salesforce.com and test.salesforce.com. Apps that previously used an embedded web view for these login servers now use a browser session.

Apps can temporarily opt out by setting forceAdvancedAuthentication to false before starting authentication:

SalesforceSDKManager.getInstance().forceAdvancedAuthentication = false

forceAdvancedAuthentication is deprecated in 14.0.0 and is planned for removal in Mobile SDK 15.0.0. Test browser-based login, logout, and account-switching flows as part of your upgrade.

Ephemeral Browser Sessions for Advanced Authentication

Browser-based Advanced Authentication now uses an ephemeral Custom Tabs session by default, so the browser doesn't persist cookies or session state across logins. This gives each login a clean browser state and keeps session data from lingering on the device. Mobile SDK warns when it can't confirm that the installed browser provider supports ephemeral sessions.

Apps can opt out by setting useEphemeralSessionForAdvancedAuth to false before starting authentication:

SalesforceSDKManager.getInstance().useEphemeralSessionForAdvancedAuth = false

The OAuth User Agent Flow Is Being Retired

Mobile SDK uses the OAuth web server flow by default for WebView login. The user agent flow, selected by setting useWebServerAuthentication to false, is being retired and is expected to no longer be supported by the server.

useWebServerAuthentication is deprecated in 14.0.0 and is planned for removal in Mobile SDK 15.0.0, or sooner if the server no longer supports the user agent flow. Remove any code that sets this flag to false so that your app always uses the web server flow.

Refresh Token Rotation Hardening

Mobile SDK now serializes token refresh requests per user. This change prevents concurrent refresh requests from racing when the server rotates a refresh token, which could otherwise cause unexpected logouts. No app changes are required.

App Attestation Preview

Mobile SDK includes client support for Salesforce App Attestation, which uses Google Play Integrity to verify app and device integrity during login. Server-side enforcement is not yet generally available. Confirm Salesforce availability and provide the Google Cloud project ID when initializing SalesforceSDKManager before enabling this feature in production.

OAuth and Authentication APIs

  • OAuth errors are available as typed OAuthErrorCode values. Migrate code that compares raw OAuth error strings to use the typed error code where possible.
  • RestClient.refreshAccessToken() is now public for apps that need to proactively refresh an access token.
  • UserAccountManager.upgradeToDPoP() upgrades an existing Bearer session to DPoP-bound credentials in place. Use this API to migrate already logged-in users before DPoP is required for their app.

Feature-Flag Telemetry

SDK feature flags are now persisted per user and included in the SDK User-Agent string. The SDK automatically records flags for login method and server type, session security such as DPoP and refresh token rotation, and other authentication characteristics. No app changes are required.

If your app registers custom SDK feature flags, migrate to SalesforceSDKManager.registerUsedAppFeature(code, user) and getUserAgent(qualifier, user).

Account and REST Client API Changes

Mobile SDK 14.0.0 changes several account-management and REST client APIs.

  • The ClientManager(Context, String, boolean) constructor has been removed. Create a ClientManager with a Context and persisted UserAccount.
  • getRestClient and RestClientCallback moved to SalesforceSDKManager.
  • peekRestClient(UserAccount) and peekRestClient(Account) have been removed. Create a manager for the target user and call no-argument peekRestClient().
  • Unauthenticated REST client APIs have been removed from ClientManager. Use SalesforceSDKManager.getUnauthenticatedRestClient().
  • Logout APIs that don't explicitly identify a user have been removed. Use UserAccountManager.signoutCurrentUser(...) or signoutUser(...).
  • Account-management methods, including createNewAccount, getAccountByName, getAccounts, and removeAccount, moved from ClientManager to UserAccountManager.
  • SalesforceSDKManager.clientManager is now nullable when no current user is persisted. Update Kotlin code to handle a null value safely.

Actionable Notifications

The Kotlin native template includes opt-in scaffolding for actionable notifications. Enable the supplied action adapter and broadcast receiver to handle notification actions and invoke the corresponding server-side action.

Other Breaking Changes

  • Override the account_type string resource with an app-specific value. Apps that use the SDK default fail at startup.
  • Mobile SDK uses OkHttp 5. Update direct calls to RequestBody.create() for the new (content, mediaType) argument order.
  • Custom push workers must use ORG_ID and USER_ID rather than the removed USER_ACCOUNT WorkManager key.
  • Push foreground registration now defaults to all users. Set PushService.foregroundRegistrationMode = CURRENT_USER to restore the previous behavior.
  • HybridApp.java has been removed. Hybrid apps that extend HybridApp must migrate to a Kotlin Application subclass that calls SalesforceHybridSDKManager.initHybrid().
  • The required FragmentManager parameter has been removed from BiometricAuthenticationManager.presentOptInDialog(). Call presentOptInDialog() with no arguments. Mobile SDK shows the dialog on its own screen.

Version Updates

  • Minimum SDK: API 31 (Android 12) or later
  • Compile SDK: API 36 or later
  • Android Gradle Plugin: 9.1.1
  • Kotlin: 2.0 or later; Mobile SDK is built with Kotlin 2.3.20
  • SQLCipher: 4.17.0
  • OkHttp: 5.3.2

Android Gradle Plugin 9 requires JDK 17. If your app uses a composite build with Mobile SDK, apply the compatible Gradle settings used by the SDK.

Android 17 Support

Mobile SDK 14.0.0 native, hybrid, and React Native templates target Android 17 (API 37). Hybrid support includes Cordova Android 15.0.0.

External Component Version Updates

  • React Native: 0.86.0
  • Cordova Android: 15.0.0

com.salesforce.mobilesdk:SalesforceReact is now published to Maven Central from the ReactNative repository, matching the Android SDK's distribution setup.

React Native New Architecture

React Native 0.86.0 requires the New Architecture. Mobile SDK React Native apps use bridgeless mode and TurboModule-based native bridges; the legacy architecture is no longer supported. The Android bridge is now included in the react-native-force package and registered through React Native autolinking, so remove any direct SalesforceReact Gradle dependency. Replace @react-navigation/stack with @react-navigation/native-stack.

Native App Templates

The Java native app-generation template has been removed. The forcedroid command now generates native apps with the Kotlin native_kotlin app type. Existing Java apps continue to work with the SDK libraries.

Removed APIs

See the Android APIs removed in Mobile SDK 14.0.0 reference for the complete list of removed APIs.

Performance and Reliability

  • DPoP proof generation caches per-user key material for the process lifetime, eliminating a repeated Android Keystore lookup on every request.
  • Account resolution is cached per user again, removing a large increase in AccountManager interprocess calls at app startup that was introduced during the 14.x work.
  • Logout now fully clears the departing account's refresh-coordination state, including its DPoP UI session ID, so a stale token response or duplicate refresh can't affect a quick re-login with the same account.
  • Developer Support (its notification and dialog) can now be shown to apps that consume the SDK as a release AAR; availability keys off the consuming app's debuggable flag rather than the SDK's own build type, so DevInfoActivity and LoginOptionsActivity behave correctly in release builds.

Deprecated APIs

The following APIs are deprecated in 14.0 and will be removed in 15.0. Compiler warnings only — they still work.

  • IDP login flow — No drop-in replacement; apps should migrate to advanced (browser-based) auth.
  • useWebServerAuthentication — The OAuth user agent flow is being retired; the web server flow will be used going forward.
  • forceAdvancedAuthentication — Planned for removal in 15.0.

For the complete list, check compiler warnings or see the Android current deprecations reference.

Agent Skills for App Developers

Mobile SDK now publishes installable agent skills that guide AI coding agents through building Android Kotlin apps with the SDK — creating a new app and adding authentication, SmartStore, MobileSync, and biometric authentication (fingerprint / face / iris) — along with guided upgrade skills for moving an app from 12.x to 13.x and from 13.x to 14.0. Add them to your project with:

npx skills add forcedotcom/SalesforceMobileSDK-Templates

See the consumer skills README for the full catalog.

How to Upgrade Your Apps

To upgrade to Mobile SDK 14.0.0:

  1. Set minSdk to at least 31 and compileSdk to at least 36. Choose the targetSdk that is appropriate for your app.
  2. Update to Android Gradle Plugin 9.1.1, a compatible Kotlin version, and JDK 17.
  3. Update Mobile SDK dependencies to version 14.0.0 and SQLCipher pins to 4.17.0, if applicable.
  4. Set an app-specific account_type resource.
  5. Migrate ClientManager, REST client, logout, account-management, and hybrid-application API calls.
  6. Test browser-based Advanced Authentication, DPoP-enabled login, and any configured App Attestation flow. For apps where DPoP is not required server-side, the temporary opt-out can provide additional migration time; it does not bypass per-app enforcement.
Assets 2
Loading