refactor: remove the legacy MFA methods from the auth client

[subhankarmaiti]

Changes

Removes the four MFA methods from the auth client, completing the move to the dedicated mfa client. They were deprecated on the v5.x line first, so consumers upgrading from a recent v5 release will already have seen the warnings.

Gone from auth0.auth: loginWithOTP(), loginWithOOB(), loginWithRecoveryCode(), and multifactorChallenge(). The equivalents on useAuth0() go with them — authorizeWithOTP, authorizeWithOOB, authorizeWithRecoveryCode, and sendMultifactorChallenge — as do the now-orphaned LoginOtpParameters, LoginOobParameters, LoginRecoveryCodeParameters, MfaChallengeParameters, and MfaChallengeResponse types.

Removed from auth0.auth	Use instead on auth0.mfa
loginWithOTP({ mfaToken, otp })	verify({ mfaToken, otp })
loginWithOOB({ mfaToken, oobCode, bindingCode })	verify({ mfaToken, oobCode, bindingCode })
loginWithRecoveryCode({ mfaToken, recoveryCode })	verify({ mfaToken, recoveryCode })
multifactorChallenge({ mfaToken, authenticatorId })	challenge({ mfaToken, authenticatorId })

- const credentials = await auth0.auth.loginWithOTP({ mfaToken, otp });
+ const credentials = await auth0.mfa.verify({ mfaToken, otp });

Nothing is lost in the move: verify() is a superset of the three loginWith* methods, since it also accepts scope and audience for the returned credentials, and the mfa client additionally supports listing and enrolling authenticators. It is implemented on iOS, Android, and web.

One migration is not a straight rename, and the migration guide calls it out: multifactorChallenge() treated authenticatorId as optional and let Auth0 pick a default factor, whereas mfa.challenge() requires it. Anyone relying on that needs to call mfa.getAuthenticators({ mfaToken }) first and pass an explicit id — with a length check, since a user can reach MFA_REQUIRED with nothing enrolled.

Summary by CodeRabbit

• Breaking Changes

  • Removed legacy MFA OTP, OOB, recovery-code, and multifactor challenge APIs and related types.
  • Use the dedicated MFA verification and challenge flows instead; challenges now require an explicit authenticator ID.

• Documentation

  • Updated migration guidance and MFA examples to reflect the new verification flow.
  • Updated sample test screens and references for MFA verification.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change removes legacy MFA authentication methods and types from core, hooks, and web adapters. Examples now use auth0.mfa.verify. The migration guide documents the removed APIs and replacement MFA client methods.

Changes

MFA API migration

Layer / File(s)	Summary
Remove legacy MFA contracts and core flows src/types/common.ts, src/types/parameters.ts, src/core/services/__tests__/AuthenticationOrchestrator.spec.ts	Legacy MFA parameter types, response types, and authentication flow tests were removed.
Remove hook and provider APIs src/hooks/Auth0Context.ts, src/hooks/Auth0Provider.tsx, src/hooks/__tests__/Auth0Provider.spec.tsx, src/platforms/web/adapters/WebAuthenticationProvider.ts	Legacy MFA context methods, provider callbacks, web adapter stubs, and test mocks were removed.
Update callers and migration guidance EXAMPLES.md, example/src/screens/class-based/ClassApiTests.tsx, MIGRATION_GUIDE.md	MFA examples now call auth0.mfa.verify. Migration guidance documents replacement MFA client methods and the explicit authenticator ID requirement.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• auth0/react-native-auth0#1517: Introduced the flexible MFA client used by the updated callers.
• auth0/react-native-auth0#1585: Modified related MFA and OTP authentication APIs and examples.
• auth0/react-native-auth0#1625: Deprecated the MFA methods removed in this change.

Suggested reviewers: nandanprabhu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: removing legacy MFA methods from the authentication client.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/remove-legacy-mfa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

EXAMPLES.md (1)

2775-2777: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the blank lines between adjacent blockquotes.

markdownlint-cli2 reports MD028 at Lines 2775 and 2777. Remove these blank lines so the documentation lint warning is cleared.

Proposed fix

 > **Platform Support:** iOS and Android. This option is ignored on web.
-
 > **Warning:** On Android, `ephemeralSession` and [`useTrustedWebActivity`](`#trusted-web-activity-android`) are effectively mutually exclusive. A Trusted Web Activity does not support ephemeral browsing, so if you enable both, TWA takes precedence and the session will **not** be ephemeral. Pick one.
-
 > **Note:** Android support for ephemeral sessions was added in v6. In earlier versions the option was accepted but only took effect on iOS.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@EXAMPLES.md` around lines 2775 - 2777, Remove the blank lines separating
adjacent blockquote lines in the Android warning near the ephemeralSession and
useTrustedWebActivity documentation, keeping the blockquote content unchanged so
markdownlint MD028 passes.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@EXAMPLES.md`:
- Around line 2775-2777: Remove the blank lines separating adjacent blockquote
lines in the Android warning near the ephemeralSession and useTrustedWebActivity
documentation, keeping the blockquote content unchanged so markdownlint MD028
passes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d88af9e-9c24-48f4-9419-8b31ec164259

📥 Commits

Reviewing files that changed from the base of the PR and between 75099a2 and 37cf1a1.

📒 Files selected for processing (2)

• EXAMPLES.md
• MIGRATION_GUIDE.md

🚧 Files skipped from review as they are similar to previous changes (1)

• MIGRATION_GUIDE.md