Livio SpringandCursor 318bfc36d7 feat: native app links for passkeys (#12580) ...

# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-12 08:04:27 +02:00

..

zitadel

feat: native app links for passkeys (#12580)

2026-08-12 08:04:27 +02:00

AGENTS.md

chore(agents): add agents files (#11497)

2026-02-16 20:45:53 -08:00

buf.lock

chore(console): buf stub build (#5215)

2023-02-17 14:09:11 +00:00

buf.yaml

fix: query organization directly from event store (#10463)

2025-08-12 09:37:08 +00:00