2026-11-09: mobile SDKs (Wave 6.2)#

• Mobile apps. platformMobileApps, registerPlatformMobileApp(input) and removePlatformMobileApp(id) (scope platform_embed:read / platform_embed:write, team role admin to change). An app is an iOS bundle id or an Android application id plus the URL scheme it owns; it gets an id fb_app_… (mobileAppId). Up to 10 per platform and environment; a sandbox app does not exist in production.
• Mobile sessions. createEmbedSession takes mobileAppId (embed sessions only, no origin). Such a session is exchanged only by the mobile shell (https://embed.finbaze.com/v1/m/<component>?app=fb_app_…), which sends mobileAppId to exchangeEmbedSession. A web session that names an app, and a mobile session without it, fail with EMBED_APP_MISMATCH. Without app attestation the app id is a binding, not proof: the protection is the same as on the web, a single-use client secret that your backend mints for a signed-in user.
• Device confirmation. The step_up provider takes stepUpMode: assertion | device_biometric (default assertion, your own signed assertion; device_biometric needs no keys). The STEP_UP_REQUIRED challenge carries mode. In device_biometric mode the mobile SDK asks for Face ID or the fingerprint and calls completeStepUpChallengeWithDeviceAssertion(challengeId); the component retries with FinBaze-Step-Up: <challengeId>.device. The challenge records method: device_local, a weaker signal than your assertion. Banks should keep assertion.
• Push hand-off. message.created carries action: { type: "open_route", route, component, params, intent, intent_expires_at } for a message with a deep link. Forward intent (opaque, signed, 7 days) in your own push. resolveEmbedIntent(intent) (server token) returns the component, company and params before you mint the session; the mobile SDKs call acknowledgeMessageIntent(id) once the component is open.
• New error code EMBED_APP_MISMATCH; new step-up error STEP_UP_DEVICE_NOT_ALLOWED.
• Not available to assistants and agents: registerPlatformMobileApp, removePlatformMobileApp, acknowledgeMessageIntent, completeStepUpChallengeWithDeviceAssertion.