Changelog

TBA

See the JavaScript SDK 5.0.0 migration guide for breaking changes and migration instructions.

• Updated the minimum supported React Native version to 0.87, Android version to 7.0 (API 24), and iOS version to 15.1. (#440)
• Updated the minimum supported iOS version for Cordova to 15.0. (#518)
• Added experimental Swift Package Manager support for iOS with React Native 0.87 or later. (#463, #416)
• Changed the Cordova plugin to use Swift Package Manager with cordova-ios 8 or later. cordova-ios 7 continues to use CocoaPods. (#554)
• Added support for OIDC activation. (#235)
• Fixed an issue where a correct password was occasionally reported as invalid. (#329)
• Updated the native PowerAuth SDK dependencies to 2.1.0. (#447, #558)
  • Android now resolves the latest native 2.1.x patch release, matching the existing iOS CocoaPods and Swift Package Manager ranges. (#546)
  • Added PowerAuthActivationStatus.blockExpirationTime with the time when a temporarily blocked activation will be unblocked.
• Changed end-to-end encryption to use an asynchronously acquired, single-use PowerAuthEncryptor for each request and response exchange. (#466)
  • Removed the legacy cryptogram, separate decryptor, encryption data-format arguments, specialized encryption-header APIs, and PowerAuthErrorCode.INVALID_ENCRYPTOR.
• Updated the JavaScript request and token authentication APIs. (#467)
  • Added PowerAuthHttpHeader, request authentication header methods, asynchronous offline authentication codes, and PowerAuthTokenStore.generateAuthenticationHeader().
  • Deprecated the legacy signature and token-header wrappers and changed token-header generation to propagate native errors directly.
• Added instance-aware biometric status and availability APIs, biometric configuration and prompt options, asynchronous factor management, and reusable biometric authentication. (#468)
• Changed groupedBiometricAuthentication() to report all callback exceptions as PowerAuthErrorCode.UNKNOWN_ERROR, including PowerAuthError exceptions whose codes were previously preserved. (#468)
• Added algorithm selection, offline authentication-code component length, asynchronous native configuration getters, current algorithm reporting, and instance-data cleanup. (#472)
• Added hasProtocolUpgradeAvailable(), hasPendingProtocolUpgrade(), startProtocolUpgrade(), and PowerAuthProtocolUpgradeResult, including an option to request biometric-factor migration on Android. (#474)
• Added the native-backed two-step password-change API with beginPasswordChange(), finishPasswordChange(), and opaque PowerAuthPasswordChangeData. (#476)
  • Deprecated the legacy one-step, validation, and unsafe password-change APIs and enforced the distinction between activation-persistence and ordinary authentication objects.
• Added explicit-key digital signatures, JWS/JWT calculation and verification, device public-key export, and certificate signing request generation with Base64 strings for binary inputs and outputs. (#479)
  • Deprecated the legacy server and device signature helpers.
• Added fetchSecureVaultKey() and the native-backed PowerAuthSecureVaultKey object with deriveKey() and release() methods. (#480)
  • Deprecated fetchEncryptionKey().
• Fixed PowerAuthPassword losing characters and leaking native passwords when used concurrently before the native password was created, or released during its creation. (#511)
  • PowerAuthPassword is no longer restored after its native password is released, used, expired, or destroyed by deconfiguration, and reports INVALID_NATIVE_OBJECT instead.
  • Changed the PowerAuthPassword constructor and fromString() to accept an options object, and removed the onAutomaticCleanup callback and its createPassword() parameter.
  • Removed BaseNativeObject and BaseReleasableObject.
• Added PowerAuthPassword.addCodePoint(), insertCodePoint(), removeCodePointAt(), removeLastCodePoint(), and addCodePoints(), which work with Unicode code points, like the native PowerAuth mobile SDK. Deprecated addCharacter(), insertCharacter(), removeCharacterAt(), removeLastCharacter(), and the CharacterType type. The deprecated methods keep their 4.x behavior, so a string passed to addCharacter() or insertCharacter() still stores only its first code point, and characters such as emoji with skin tone modifiers are silently truncated. (#310)
• Removed the deprecated PowerAuthAuthentication constructor, the mutable usePossession, useBiometry, userPassword, biometryMessage, and biometryTitle properties, and convertLegacyObject(). Use the static factories instead. This also removes an issue where constructor arguments were ignored, so signing used possession only. (#509)

4.2.0 (12/2025)

• Added PowerAuthCryptoUtils with functions for hashing and random bytes generation (see Crypto Utilities for more details)
• Added helper method to create PowerAuthPassword from string (PowerAuthPassword.fromString) (see Secure Password for more details)
• Added User Info feature to retrieve user-related information from the server
• Added PowerAuthStorageUtils cache API with secure & standard storage (see Storage Utilities)
• Fixed bridged native error processing on Cordova (issue#302)

4.1.3 (9/2025)

• Token-based authentication now automatically synchronizes time if needed (see Token-Based Authentication for more details)

4.1.2 (9/2025)

• Fixed Android Encryptor crashing on missing putLong JNI bindings (issue #264)
• Added Time Synchronization service

4.1.1 (7/2025)

• Upgraded the PowerAuth native SDK to 1.9.5
  • Biometric authentication offloaded to the background thread

4.1.0 (6/2025)

• Opportunity to sign Base64 encoded data with signDataWithDevicePrivateKey
  • we added the dataFormat parameter with possible UTF8 and BASE64 values for the data to be signed
• Added PowerAuthUtils that provides getEnvironmentInfo with device, system and app info
• Fixed issue on Cordova when iPadOS was recognized as Android in some cases
• Fixed validatePassword API on iOS that returned wrong value

3.2.0 (6/2025)

• Added PowerAuthUtils that provides getEnvironmentInfo with device, system and app info
• Fixed issue on Cordova when iPadOS was recognized as Android in some cases

4.0.0 (5/2025)

• Migration to the latest native PowerAuthSDK stack (1.9.x)
  • Use migration guide for a smooth migration

3.1.0 (5/2025)

• Support for the new React Architecture

3.0.1 (4/2025)

• Native PowerAuth SDK version raised to 1.7.12
  • Fixed build problems on Xcode 16.3
  • OpenSSL upgraded to version 1.1.1w

3.0.0 (1/2025)

• Library renamed to PowerAuth Mobile JS
• Added Cordova support