The FDI spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.6.0.md

• New API: {apiBasePath}/signinup
• New API: {apiBasePath}/signout
• New API: {apiBasePath}/authorisationurl

Email verification related changes

• Moved {apiBasePath}/user/email/verify/token to its own recipe (email verification)
• Moved {apiBasePath}/user/email/verify to its own recipe (email verification)
• Moved {apiBasePath}/user/email/verify to its own recipe (email verification)

• auth-react
• supertokens-website
• auth0-spa-js
• react-native
• ios
• android
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

Changes

• Adding passwordless recipe APIs
  • /signinup/code
  • /signinup/code/consume
  • /signup/email/exists
  • /signup/phoneNumber/exists

SDKs:

• NodeJS
• Golang
• Python
• website
• auth-react
• react-native

The FDI spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.5.0.md

• New API: {apiBasePath}/user/email/verify/token POST

• New API: {apiBasePath}/user/email/verify POST

• New API: {apiBasePath}/user/email/verify GET

• auth-react

• auth0-spa-js

• react-native

• ios

• android

• nodejs

• javalin

• flask

• fastapi

• golang

• laravel

Discussion points:

• What should the output of {apiBasePath}/user/email/verify/token be if the email is already verified? Should it just be OK?
• Are the API paths OK?

FDI Spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.9.0.md

Email OTP Recipe

• {apiBasePath}/signin POST
• {apiBasePath}/signup POST
• {apiBasePath}/signinup/email/exists GET
• {apiBasePath}/signinup/otp POST

• auth-react
• supertokens-website
• auth0-spa-js
• react-native
• ios
• android
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

The FDI spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.4.0.md

• New API: {apiBasePath}/email/exists

• auth-react

• auth0-spa-js

• react-native

• ios

• android

• nodejs

• javalin

• flask

• fastapi

• golang

• laravel

Frontend SDKs must

• API requests have a fdi-version header for versioning purposes. The format is a X.Y,X1.Y1... for example 1.2,3.4,1.1. In the driver, we must take care to remove spaces and then get the latest common version between the two SDKs (like we do for CDI)

Drivers must:

• Extracting the latest, common (between frontend and backend SDK) FDI version from the request and passing that to the module. If no FDI is present, then assume the latest FDI supported by the backend SDK. If FDI is present, but none matching, then throw an appropriate error.
• This also needs to be exposed in Access-Control-Allow-Headers
• If it is missing, we assume the latest version supported by the driver.

• supertokens-website
• supertokens-auth-react
• ios
• android
• react native
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

The FDI spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.3.0.md

• All API requests must have an optional rid header. This also needs to be exposed in Access-Control-Allow-Headers
• Removal of supertokens-sdk-name and supertokens-sdk-version
• Refresh API URL change
• New API: {apiBasePath}/signin
• New API: {apiBasePath}/signup
• New API: {apiBasePath}/user/password/reset/token
• New API: {apiBasePath}/user/password/reset

• website
• auth-react
• auth0-spa-js
• react-native
• ios
• android
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

• Adds authCodeResponse to thirdparty and thirdpartyemailpassword's signinup POST API to support auth code exchange via PKCE method.
• Adds an optional clientId in signinup API to thirdparty and thirdpartyemailpassword
• Adds apple sign in callback API

SDKs:

• NodeJS
• Golang
• Python
• website
• auth-react
• react-native

Manual Testing:

• All backend SDKs with auth-react tests without SKIP_OAUTH=true
• All backend SDKs with react native demo app

Other TODOs:

• Move FDI into master and on swagger hub

• All requests that go through session interception will have a custom header rid to prevent CSRF attacks (see this). The backend would then need to check for the existence of this header in case CSRF is enabled

• auth-react
• supertokens-website
• auth0-spa-js
• react-native
• ios
• android
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

The FDI spec: https://github.com/supertokens/frontend-driver-interface/blob/master/v1.7.0.md

• New API: {apiBasePath}/session/signout

• auth-react
• supertokens-website
• auth0-spa-js
• react-native
• ios
• android
• nodejs
• javalin
• flask
• fastapi
• golang
• laravel

The payload to send to /auth/signinup/code must also include a phone number or email.

Otherwise we receive:

{"message": "Please provide exactly one of email or phoneNumber"}