Orchestration SDKs

Orchestration SDK for Android changelog

Orchestration SDK for Android 2.2.0

September 25, 2026

Key features

PingOne Recognize

A new recognize module provides privacy-preserving facial biometrics for enrollment and sign-in in authentication journeys.

Learn more in Integrating PingOne Recognize.

Backchannel authentication [SDKS-5157]

The Orchestration SDK now supports transactional backchannel authentication in authentication journeys, so a third party can initiate a sign-in or transaction on behalf of your user, and your app completes it after the user approves it on their device.

This is not OIDC Client-Initiated Backchannel Authentication (CIBA).

This feature uses a proprietary backchannel authentication mechanism in Advanced Identity Cloud and PingAM; a transactional authentication pattern that is unrelated to the OIDC CIBA grant type.

Learn more in Backchannel authentication.

PingOne MFA integration

A new pingonemfa module turns your Android app into a second authentication factor for sign-ons started on another device, such as a web browser or kiosk. It supports device pairing in a DaVinci flow with MobilePairingCollector, push notification approval and denial including number matching, and OATH one-time passcode generation.

Learn more in Integrating with PingOne MFA on Android.

Added

  • Added MetadataCollector for DaVinci flows to support exchanging custom SDK metadata. [SDKS-5168]

  • Added ImageCollector for DaVinci forms to display images. [SDKS-5169]

  • Added an optional HTTP status code to ErrorNode. [SDKS-5202]

Changed

  • Changed FIDO2 authentication to support per-request API selection with useFido2ApiClient. [SDKS-5411]

Fixed

  • Fixed the browser redirect URI scheme manifest placeholder to apply only to debug builds, allowing release consumers to provide their own value. [SDKS-5296]

  • Fixed Journey submitButtonText/pageFooter to resolve against the device’s ordered preferred-locale list. [SDKS-5310]

  • Fixed OIDC refresh() to no longer delete the cached token from storage or revoke a non-expired access token before refreshing. [SDKS-5414]

  • Fixed OAuth 2.0 Device Authorization Grant polling to retry on transient network and transport failures instead of terminating the flow. [SDKS-5124]

  • Fixed AbstractValidatedCallback throwing when PingAM returns an empty policies array instead of an object. [SDKS-5260]

  • Fixed QRCodeCollector.id() to return a stable key from the collector configuration instead of a random value. [SDKS-5293]

  • Fixed FIDO2 collectors to report WebAuthn and credential errors as actionable events instead of generic submit failures. [SDKS-4477]

  • Fixed Journey FIDO2 passkey registration crashes on API 33. [SDKS-5411]

  • Fixed Jackson dependency versions to address security vulnerabilities (CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515). [SDKS-5199]

  • Fixed missing blank-secret validation on OathCredential, and OathType now serializes as lowercase.

Orchestration SDK for Android 2.1.0

July 7, 2026

Key features

Pushed Authorization Requests (PAR) [SDKS-4231]

PAR sends OAuth 2.0 authorization parameters directly to the server before the redirect begins, keeping them out of the browser URL and reducing the chance of them being tampered with or exposed in logs or referrer headers.

Learn more in Configuring Android apps for Pushed Authorization Requests.

OAuth 2.0 Device Authorization Grant [SDKS-4784]

The Device Authorization Grant is designed for devices with no browser or keyboard, such as smart TVs or set-top boxes. Users authenticate on a secondary device like a phone, and the primary device receives a token once sign-in completes.

Learn more in Configuring Android apps for the Device Authorization Grant.

Standardized JSON configuration [SDKS-5065]

All SDK modules now support a shared JSON object or file for configuration. This makes it straightforward to manage settings across environments and to share a single configuration file across Android, iOS, and JavaScript.

Learn more in:

Android 17 support [SDKS-5191]

Verified the Orchestration SDK for Android works with Android 17.

Enhancements

  • Added PollingCollector for DaVinci flows. [SDKS-4681]

  • Added QrCodeCollector for DaVinci flows. [SDKS-4679]

  • Added BooleanCollector to support Checkbox and Switch input types in DaVinci forms. [SDKS-4919]

  • Added ReadOnlyTextCollector for DaVinci forms to support Terms of Service and agreement displays. [SDKS-4927]

  • Added support for links in Translatable Rich Text (Forms). [SDKS-4246]

  • Added support for phone number extensions in PhoneNumberCollector. [SDKS-4669]

Fixes

  • Fixed OATH and Push URI parsers to propagate typed InvalidUriException for structural URI parse errors. [SDKS-5074]

  • Fixed Ktor CIO engine dropping repeated Set-Cookie headers with mixed casing (KTOR-8614 workaround). [SDKS-4742]

  • Fixed Push Number Challenge not surfacing a distinct failure for wrong-number responses. [SDKS-5116]

  • Fixed PasswordCollector not handling nested Password policies. [SDKS-4694]

Orchestration SDK for Android 2.0.1

June 1, 2026

Fixes

  • Upgraded bcpkix-jdk18on from 1.81 to 1.84 to address a security vulnerability (CVE-2026-5588).

Orchestration SDK for Android 2.0.0

April 15, 2026

Key features

Initial release

The initial release of the Orchestration SDK for Android is now available with new features and additional support.

This release supports the following key features:

Enhancements

  • Added new network module. [SDKS-4505]

  • Added new mfa-commons module. [SDKS-4106]

  • Added new auth-migration module. [SDKS-4716]

  • Added new device-binding-migration modules. [SDKS-4115]

  • Added new device-id module. [SDKS-4120]

  • Added new device-root module. [SDKS-4365]

DaVinci client for Android 1.3.0

November 28, 2025

Enhancements

  • Added support for PingOne Protect, by using the new PingProtect module. [SDKS-4069]

    Learn more in Evaluating risk with PingOne Protect.

  • Added support for Android 16 and updated compileSdk to version 36 and minSdk to 29. [SDKS-4278]

Fixes

  • Enhanced form handling in the DaVinci SDK to automatically reset form values after submission. [SDKS-4511]

  • Improved SDK storage configuration to simplify overrides. [SDKS-4109]

  • Enhanced Storage module with cache strategy support. [SDKS-4112]

  • Refactored logger initialization for session and cookie configurations. [SDKS-4358]

  • Updated PhoneNumberCollector to support new JSON format. [SDKS-4198]

  • Upgraded datastore library to version 1.1.7. [SDKS-4207]

DaVinci client for Android 1.2.0

July 8, 2025

Enhancements

  • Added support for native social login with Google and Facebook. [SDKS-3449]

  • Added support for PingOne Forms one-time passcode (MFA) components DEVICE_REGISTRATION, DEVICE_AUTHENTICATION, and PHONE_NUMBER. [SDKS-3562]

  • Added access to the previous ContinueNode node from an ErrorNode. [SDKS-3890]

  • Added access to the key attribute of LabelCollector. [SDKS-3957]

  • Added support for StrongBox when generating keys. [SDKS-4098]

DaVinci client for Android 1.1.0

April 17, 2025

Enhancements

  • Added support for additional PingOne Form fields. [SDKS-3649]

    • Label

    • Checkbox

    • Dropdown

    • Combobox

    • Radio list

    • Flow link

  • Added an external-idp module to support social sign on with supported external IDPs by using browser redirects. [SDKS-3662]

    Supported external IDPs:

    • Apple

    • Facebook

    • Google

  • Added Accept-Language header to support localization. [SDKS-3622]

  • Added ability to validate PingOne Form fields. [SDKS-3649]

  • Added support for default values in PingOne Form fields. [SDKS-3649]

  • Added an interface to access ErrorNode and validation errors. [SDKS-3649]

  • Added a browser module. [SDKS-3662]

  • Added dynamic environment switching in the test sample app. [SDKS-3642]

Fixes

  • Fixed an issue affecting the global logger when configuring a logger in DaVinci client configuration. [SDKS-3616]

DaVinci client 1.0.0

December 16, 2024

Enhancements

  • Initial release of the DaVinci client for Android.