What's New in Mobile SDK 13.2.1
Phishing-Resistant MFA via Login for Admin
- Note: Starting in June 2026, Salesforce prompts users to enter only their username as the first login step. Based on the username, Salesforce then prompts the user to enter their password or to use a passkey. This two-step flow works with existing Mobile SDK apps and doesn't require code changes. However, if your automated tests assume the previous login flow, update those tests to support the new sequence.
We added a Login for Admin menu item that forces advanced, browser-based authentication, which is a requirement for phishing-resistant multi-factor authentication (MFA). After forcing advanced authentication, the Login for Admin flow prompts the user to register or log in with a passkey. In Mobile SDK 13.2.0 and earlier, admin users can be blocked from logging in unless their org preconfigures advanced authentication in their My Domain settings and uses the My Domain URL to log in. See Using Advanced Authentication.
Passkey and Identity Verification Support
We added passkey and identity verification support for enhanced authentication security. If configured to enable passkeys, the app automatically prompts the user to verify their identity and save a passkey when logging in. If not enabled by default, passkeys can be configured on the server-side. See Salesforce Help: Enable Passwordless Login with Passkeys.