Orchestration SDKs

Orchestration SDK for iOS changelog

Orchestration SDK for iOS 2.2.0

October 20, 2026

Key features

PingOne Recognize

A new recognize module provides privacy-preserving facial biometrics for enrollment and sign-in in authentication journeys.

Learn more in Integrating PingOne Recognize.

Facebook Limited Login

Sign in to Facebook using the OIDC ID-token flow instead of the classic access-token login.

In PingOne Advanced Identity Cloud and PingAM journeys, configure an OIDC Social Identity Provider with a name containing fb-limited to opt in; existing provider names such as facebook continue to use classic access-token login.

In DaVinci Custom HTML and PingOne Forms, set the new facebookLimitedLoginEnabled property on the Facebook collector to choose between the classic accessToken and Limited Login idToken payloads.

Learn more in Authenticating with external identity providers on iOS.

PingOne MFA integration

A new pingonemfa module turns your iOS app into a second authentication factor for sign-ons started on another device, such as a web browser or kiosk. It supports device pairing in a DaVinci flow with MobilePairingCollector, push notification approval and denial including number matching, and OATH one-time passcode generation.

Learn more in Integrating with PingOne MFA on iOS.

Added

  • Added ImageCollector to support image display in DaVinci forms. [SDKS-5143]

  • Added MetadataCollector to support the DaVinci SDK Integrator connector’s pause/resume model, so the app can invoke on-device SDKs and return a result or error before the flow continues. [SDKS-5142]

  • Added trigger and isAutomatic properties to the DaVinci FIDO collectors. [SDKS-4552]

  • Added a present-only launch mode to BrowserLauncher through browserMode: .custom.

    launch() resolves as soon as the browser UI is presented, without waiting for a callback. Use this for use cases such as session handoff or in-app SSO, where no redirect back to the app is expected. [SDKS-5357]

  • Added OidcError.configurationError to report a configuration that has neither a usable discoveryEndpoint nor a pre-supplied openId object. [SDKS-5301]

  • Added opt-in commercial device-model-name resolution to DeviceProfileCallback through PlatformCollector(includeModelName: true); the default PlatformCollector() payload is unchanged. [SDKS-5275]

Updated

  • Redesigned the PingExample sample app with a shared design system. [SDKS-5054]

  • Updated the Facebook iOS SDK dependency to 18.1.0. [SDKS-5160]

  • The oidc.discoveryEndpoint property in unified JSON configuration is now required only when no oidc.openId sub-object is supplied.

    An openId block without discoveryEndpoint replaces the discovery document and requires tokenEndpoint. [SDKS-5301]

  • Restored OidcClientConfig.openId as a publicly settable property, and oidcInitialize() now skips OpenID discovery when it is pre-supplied, restoring the 2.0.0 no-discovery configuration path. [SDKS-5301]

Breaking changes

  • PingJourney no longer has a hard dependency on PingDeviceProfile. [SDKS-5443]

    Previously, every PingJourney consumer’s binary transitively linked PingDeviceProfile, whose BluetoothCollector instantiates CBCentralManager, causing App Store Connect to flag the app for a missing NSBluetoothAlwaysUsageDescription even when no DeviceProfileCallback node was used.

    If your journeys use the Device Profile Collector node, add the PingDeviceProfile product or pod explicitly to your own Package.swift or Podfile.

  • OidcError has a new configurationError case, so exhaustive switch statements over OidcError need a new branch. [SDKS-5301]

Changed

  • A JSON configuration with a blank oidc.discoveryEndpoint and no oidc.openId sub-object now fails at parse time instead of at first use. [SDKS-5301]

  • OidcClientConfig.oidcInitialize() cancellation is now isolated per caller: cancelling one caller’s own task still returns promptly with CancellationError, but no longer cancels the shared discovery operation for any other caller currently sharing it. [SDKS-5301]

  • CallbackRegistry.callback(from:) now logs a debug message when a journey response contains a callback type with no registered handler, such as a DeviceProfileCallback in an app that did not add the PingDeviceProfile module, making the missing-module misconfiguration diagnosable instead of silently dropping the callback. [SDKS-5443]

  • SubmitCollector, FlowCollector, and MetadataCollector now expose actionKey through the new ActionKeyProvider protocol. [SDKS-5290]

Fixed

  • Fixed DaVinci FIDO registration and authentication not launching automatically when the form’s trigger property is not BUTTON. [SDKS-4552]

  • Fixed FIDO2 client-side WebAuthn errors (cancellation, timeout, and similar) not routing to the DaVinci error branch. [SDKS-4478]

  • Fixed QRCodeCollector not preserving the complete QR code data URI in content. [SDKS-5299]

  • Fixed OidcWebClient .authSession and .ephemeralAuthSession not completing for Universal Link (https) redirect URIs. [SDKS-5239]

  • Fixed OidcWebClient.authorize() collapsing FailureNode.cause to .unknown, losing typed browser-cancellation and unsupported-OS error identity. [SDKS-5295]

  • Fixed 5xx PingAM responses with a parseable error body being misclassified as FailureNode instead of ErrorNode, diverging from Android. [SDKS-5358]

  • Fixed Journey.start(backchannelUri:) not rejecting whitespace-only authIndexType and authIndexValue, diverging from Android. [SDKS-5359]

  • Fixed the asynchronous OidcClient.generateAuthorizeUrl(customParams:) silently falling back to the standard (non-PAR) flow when called before OidcClientConfig.oidcInitialize(), which could emit additionalParameters onto the returned URL instead of the PAR POST body. The synchronous overload never supported PAR and is unaffected. [SDKS-5403]

  • Fixed swift build (macOS) failing in PingOidc: OidcDeviceClient.authorize(verificationUriComplete:) now throws BrowserError.httpsCallbackUnsupportedOS on non-iOS platforms instead of referencing the iOS-only BrowserLauncher type, and the PingOneMFA target’s PingOneSDK dependency is iOS-conditioned. [SDKS-5443]

Orchestration SDK for iOS 2.1.1

September 4, 2026

Updated

  • Updated RecaptchaEnterprise dependency to 18.9.1 for Xcode 27 and iOS 27 compatibility. [SDKS-5306]

Orchestration SDK for iOS 2.1.0

July 22, 2026

Key features

Pushed Authorization Requests (PAR) [SDKS-4235]

PAR sends OAuth 2.0 authorization parameters directly to the server before the redirect begins, keeping them out of the browser URL and reducing the chance of them being tampered with or exposed in logs or referrer headers.

Learn more in Configuring iOS apps for Pushed Authorization Requests.

OAuth 2.0 Device Authorization Grant [SDKS-4785]

The Device Authorization Grant is designed for devices with no browser or keyboard, such as smart TVs or set-top boxes. Users authenticate on a secondary device like a phone, and the primary device receives a token once sign-in completes.

Learn more in Configuring iOS apps for the Device Authorization Grant.

Standardized JSON configuration [SDKS-5066]

All SDK modules now support a shared JSON object or file for configuration. This makes it straightforward to manage settings across environments and to share a single configuration file across Android, iOS, and JavaScript.

Learn more in:

Enhancements

  • Added PollingCollector for DaVinci flows. [SDKS-4682]

  • Added QRCodeCollector for DaVinci flows. [SDKS-4680]

  • Added BooleanCollector to support Checkbox and Switch input types in DaVinci forms. [SDKS-4920]

  • Added ReadOnlyTextCollector for DaVinci forms. [SDKS-4928]

  • Added rich text and embedded link support to LabelCollector through new RichContent and RichContentReplacement types. [SDKS-4245]

  • Added support for phone number extensions in PhoneNumberCollector. [SDKS-4668]

  • Added PushError.pushNumberChallengeError to surface a distinct failure for Push Number Challenge responses. [SDKS-5115]

  • Added preferImmediatelyAvailableCredentials option to FIDO authentication to restrict the ceremony to locally-available credentials only, if they exist. [SDKS-5212]

  • Added AuthMigration module for migrating existing sessions from the legacy ForgeRock SDK. [SDKS-4773]

  • Added Page Node description, header, and footer support. [SDKS-4762]

Fixes

  • Fixed permanent authentication failure after iCloud device migration caused by a Secure Enclave key mismatch. [SDKS-5172]

  • Fixed PingFido WebAuthn registration ignoring the configured displayName during passkey creation. [SDKS-5211]

  • Fixed PasswordCollector not handling nested password policies. [SDKS-4695]

  • Fixed PIN verification during device binding registration. [SDKS-5015]

  • Fixed Protect collector being triggered multiple times within a flow. [SDKS-4769]

  • Fixed browser close and reset logic. [SDKS-4717]

  • Fixed device binding authenticators incorrectly reporting as supported on the simulator. [SDKS-4836]

  • Fixed DeviceBindingConfig device name defaulting to the user-assigned name instead of the device model. [SDKS-4850]

  • Fixed DefaultDeviceIdentifier to reuse the legacy device identifier when available. [SDKS-4630]

  • Fixed Swift build failures caused by a platform bump and missing canImport guards. [SDKS-4916]

  • Fixed FIDO ceremony logs not routing through the workflow logger. [SDKS-4924]

Orchestration SDK for iOS 2.0.0

April 15, 2026

Key features

Initial release

The initial release of the Orchestration SDK for iOS is now available with new features and additional support.

This release supports the following key features:

Enhancements

  • Added new PingNetwork module. [SDKS-4496]

  • Added new PingDeviceId module. [SDKS-4122]

  • Added new PingTamperDetector module. [SDKS-4366]

  • Added new PingJourneyPlugin and PingDavinciPlugin modules. [SDKS-4492]

  • Added new PingCommons module. [SDKS-4104]

  • Added support for core callbacks in the PingJourney module. [SDKS-4060]

  • Added support for native social login to Facebook, Google, and Apple in Advanced Identity Cloud and PingAM journeys. [SDKS-3898]

  • Added migration mechanism for existing device binding data from the ForgeRock SDK to the Orchestration SDK for iOS. [SDKS-4495]

Fixes

  • Updated PingStorage module to allow multiple DaVinci/Journey instances to have separate cookies, sessions, and token storage. [SDKS-4588]

DaVinci client for iOS 1.3.1

November 25, 2025

Updated

  • Updated all targets to use the Swift 6 compiler. [SDKS-4499]

Fixes

  • Fixed an issue in the PingProtect module causing a crash on iOS 17+ due to an incorrect actor executor assumption. [SDKS-4494]

DaVinci client for iOS 1.3.0

October 23, 2025

Enhancements

Updated

  • Updated to handle the country code format in the PhoneNumber collector. [SDKS-4199]

  • Redesigned and improved the PingExample app. [SDKS-4104]

DaVinci client for iOS 1.2.0

July 8, 2025

Enhancements

  • Added support for native social login with Apple, Google, and Facebook. [SDKS-3450]

  • Added support for PingOne Forms one-time passcode (MFA) components DEVICE_REGISTRATION, DEVICE_AUTHENTICATION, and PHONE_NUMBER. [SDKS-3563]

  • Added access to the previous ContinueNode node from an ErrorNode. [SDKS-3891]

  • Added access to the key attribute of LabelCollector. [SDKS-3956]

Fixes

  • Resolved an issue where cookies were incorrectly cleared from in-memory storage when requests contain a Set-Cookie header [SDKS-4189]

Changes

  • Renamed the PingExternal-idp module to PingExternalIdP. [SDKS-3958]

    You must update the module name in your code if you are using the previous module name and upgrade to DaVinci client for iOS 1.2.0.

DaVinci client for iOS 1.1.0

April 17, 2025

Enhancements

  • Added support for additional PingOne Form fields. [SDKS-3671, SDKS-3672]

    • Label

    • Checkbox

    • Dropdown

    • Combobox

    • Radio list

    • Flow link

  • Added an external-idp module to support social sign on with supported external IDPs by using browser redirects. [SDKS-3720, SDKS-3920]

    Supported external IDPs:

    • Apple

    • Facebook

    • Google

  • Added Accept-Language header to support localization. [SDKS-3623]

  • Added ability to validate PingOne Form fields. [SDKS-3671, SDKS-3672]

  • Added support for default values in PingOne Form fields. [SDKS-3674]

  • Added a PingBrowser module. [SDKS-3920]

  • Added Swift 6 support. [SDKS-3728]

DaVinci client 1.0.0

December 16, 2024

Enhancements

  • Initial release of the DaVinci client for iOS.