SDK 1.4.6November 6, 2026Backward compatible

AllAuth React SDK 1.4.6: in-app two-factor verification

Applications can explicitly display the shared AllAuth authenticator or backup-code challenge inside their own sign-in screen. AllAuth continues to verify the factor and resume native OAuth; existing integrations retain hosted verification unless they upgrade and opt in.

Download 1.4.6 Source at v1.4.6 GitHub release

What changed

Enable brokerTwoFactor: { signInUrl: "/sign-in" } on the standard Next.js /api/allauth proxy after the public local sign-in page renders the matching portable SDK SignIn component. The matching AllAuth service must be deployed; older services keep hosted MFA.
Expiring handoffs are bound to the registered application, exact origin and initiating browser. Central session cookies stay on AllAuth, and native single-use challenges, attempt limits, lockout, rate limiting, OAuth state and PKCE remain authoritative.
After verification, a short browser redirect restores the AllAuth session and resumes native OAuth. Required consent may still display its hosted screen. Authenticator and backup codes are supported; custom proxy base paths and the optional Better Auth UI registry wrapper retain hosted MFA.
Existing application-account MFA, direct providers, cookies and signed requests remain compatible. Customer upgrades are explicit, every previous archive is retained unchanged, and no database migration is required.

Compatibility and upgrading

This release preserves existing APIs, sign-in flows and organisation permissions. Update the pinned SDK and its same-origin proxy together, then test and deploy your application.

Install and upgrade guide Compare SDK versions

Verified package

The versioned archive keeps its original URL. Verify the downloaded file against this SHA256 checksum.

https://allauth.co/sdk/allauth-react-1.4.6.tgz

3e19d53f8fd90267b525412cdbeebe9182180608d8621777b81b6dfc6d1e69b5

Release provenance

release

Immutable GitHub release v1.4.6 was published at 2026-11-06T21:30:55Z from SDK-only source 53081928e161e41cf88704303f3aa879b32b720d. Its exact archive and checksum asset digests match the reviewed candidate; the release workflow passed all 19 archive/tag checks, 18 public regressions, source scanning and strict typechecking before publication. Matching platform deployment and production browser acceptance are recorded separately.

Reviewed package files: broker-two-factor-server.ts, next.ts, react.tsx, README.md

What changed

Enable brokerTwoFactor: { signInUrl: "/sign-in" } on the standard Next.js /api/allauth proxy after the public local sign-in page renders the matching portable SDK SignIn component. The matching AllAuth service must be deployed; older services keep hosted MFA.

Expiring handoffs are bound to the registered application, exact origin and initiating browser. Central session cookies stay on AllAuth, and native single-use challenges, attempt limits, lockout, rate limiting, OAuth state and PKCE remain authoritative.

After verification, a short browser redirect restores the AllAuth session and resumes native OAuth. Required consent may still display its hosted screen. Authenticator and backup codes are supported; custom proxy base paths and the optional Better Auth UI registry wrapper retain hosted MFA.

Existing application-account MFA, direct providers, cookies and signed requests remain compatible. Customer upgrades are explicit, every previous archive is retained unchanged, and no database migration is required.

Release provenance

release

Reviewed package files: broker-two-factor-server.ts, next.ts, react.tsx, README.md