From c30b826e7fe4d9ba2c517ae3c6a056fb937dabf5 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Tue, 8 Sep 2026 08:12:06 +0530 Subject: [PATCH 1/9] docs(examples): add Experiment Center override example --- EXAMPLES.md | 1 + examples/experiment-center.md | 89 +++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+) create mode 100644 examples/experiment-center.md diff --git a/EXAMPLES.md b/EXAMPLES.md index 8704ae4ae..f584f7e2d 100644 --- a/EXAMPLES.md +++ b/EXAMPLES.md @@ -11,6 +11,7 @@ Each topic lives in its own file under [`examples/`](examples). - [Ephemeral Browsing](examples/ephemeral-browsing.md) - [Auth Tab](examples/auth-tab.md) - [DPoP](examples/dpop.md) +- [Experiment Center](examples/experiment-center.md) - [Handling Configuration Changes During Authentication](examples/configuration-changes.md) ## Authentication API diff --git a/examples/experiment-center.md b/examples/experiment-center.md new file mode 100644 index 000000000..faa2d3eb7 --- /dev/null +++ b/examples/experiment-center.md @@ -0,0 +1,89 @@ +# Experiment Center + +[Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. It lets you split traffic across variants, measure results, and promote the winner — all inside Auth0. + +Pass `experiment_id` and `variation_id` via `withParameters()` to force a user into a specific variation for the login request, bypassing the server-side deterministic assignment. Both IDs are obtained from your Auth0 Dashboard or the Management API. + +```kotlin +WebAuthProvider.login(account) + .withParameters(mapOf( + "experiment_id" to "", + "variation_id" to "" + )) + .start(this, callback) +``` + +
+ Using coroutines + +```kotlin +WebAuthProvider.login(account) + .withParameters(mapOf( + "experiment_id" to "", + "variation_id" to "" + )) + .await(this) +``` + +
+ +
+ Using Java + +```java +WebAuthProvider.login(account) + .withParameters(new HashMap() {{ + put("experiment_id", ""); + put("variation_id", ""); + }}) + .start(this, callback); +``` + +
+ +When the experiment uses segment targeting, also pass `segment_id`: + +```kotlin +WebAuthProvider.login(account) + .withParameters(mapOf( + "experiment_id" to "", + "variation_id" to "", + "segment_id" to "" + )) + .start(this, callback) +``` + +
+ Using coroutines + +```kotlin +WebAuthProvider.login(account) + .withParameters(mapOf( + "experiment_id" to "", + "variation_id" to "", + "segment_id" to "" + )) + .await(this) +``` + +
+ +
+ Using Java + +```java +WebAuthProvider.login(account) + .withParameters(new HashMap() {{ + put("experiment_id", ""); + put("variation_id", ""); + put("segment_id", ""); + }}) + .start(this, callback); +``` + +
+ +> [!NOTE] +> Experiment Center is an Enterprise feature. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions. +> +> Only `WebAuthProvider` login reaches Experiment Center. Embedded/native login and ROPG skip `/authorize` entirely and do not support experiment overrides. From cde6675b3f81fddad7992a255ab72d54a4bb3d9c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 15:18:02 +0530 Subject: [PATCH 2/9] chore(deps): bump the codeql group with 3 updates (#1073) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bde953cf6..d0746e617 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,15 +45,15 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: languages: ${{ matrix.language }} queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: category: "/language:${{ matrix.language }}" From 1b55d7494889d4624256ec716b6cb1c54813531b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 15:50:29 +0530 Subject: [PATCH 3/9] chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 (#1074) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 639b17571..fdec93a68 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -29,4 +29,4 @@ jobs: - run: ./gradlew testReleaseUnitTest jacocoTestReleaseUnitTestReport lintRelease --continue --console=plain - - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # pin@7.0.0 + - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # pin@7.1.1 From 2731412cc0d98d0a656857783d7eebda590fa610 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Tue, 22 Sep 2026 15:50:11 +0530 Subject: [PATCH 4/9] docs: address review feedback for Experiment Center example - Simplify to single example with all 3 params (experiment_id, variation_id, segment_id) across Kotlin/coroutine/Java - Add param descriptions and mention segment_id in intro - Add Beta + development-tenant limitation to NOTE callout - Add Experiment Center section to README.md Co-Authored-By: Claude Sonnet 4.6 --- README.md | 17 ++++++++++++ examples/experiment-center.md | 51 ++++++----------------------------- 2 files changed, 25 insertions(+), 43 deletions(-) diff --git a/README.md b/README.md index 440b99c86..b84c00226 100644 --- a/README.md +++ b/README.md @@ -316,6 +316,23 @@ WebAuthProvider.login(account) .await(this) ``` +### Experiment Center + +[Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. Pass `experiment_id`, `variation_id`, and optionally `segment_id` via `withParameters()` to force a specific variation on a Web Auth login request: + +```kotlin +WebAuthProvider.login(account) + .withParameters(mapOf( + "experiment_id" to "", + "variation_id" to "", + "segment_id" to "" // optional + )) + .start(this, callback) +``` + +> [!NOTE] +> Experiment Center is currently in Beta and runs only on development tenants. See the [full usage example](examples/experiment-center.md) for coroutine and Java samples. + ## Credentials Manager This library ships with two additional classes that help you manage the Credentials received during authentication. diff --git a/examples/experiment-center.md b/examples/experiment-center.md index faa2d3eb7..aa42c726d 100644 --- a/examples/experiment-center.md +++ b/examples/experiment-center.md @@ -2,53 +2,18 @@ [Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. It lets you split traffic across variants, measure results, and promote the winner — all inside Auth0. -Pass `experiment_id` and `variation_id` via `withParameters()` to force a user into a specific variation for the login request, bypassing the server-side deterministic assignment. Both IDs are obtained from your Auth0 Dashboard or the Management API. +Pass `experiment_id`, `variation_id`, and optionally `segment_id` via `withParameters()` to force a user into a specific variation for the login request, bypassing the server-side deterministic assignment. All three IDs are obtained from your Auth0 Dashboard or the Management API: -```kotlin -WebAuthProvider.login(account) - .withParameters(mapOf( - "experiment_id" to "", - "variation_id" to "" - )) - .start(this, callback) -``` - -
- Using coroutines - -```kotlin -WebAuthProvider.login(account) - .withParameters(mapOf( - "experiment_id" to "", - "variation_id" to "" - )) - .await(this) -``` - -
- -
- Using Java - -```java -WebAuthProvider.login(account) - .withParameters(new HashMap() {{ - put("experiment_id", ""); - put("variation_id", ""); - }}) - .start(this, callback); -``` - -
- -When the experiment uses segment targeting, also pass `segment_id`: +- `experiment_id` — the ID of the experiment to target +- `variation_id` — the specific variation to assign to this user +- `segment_id` — _(optional)_ restricts the override to a particular audience segment within the experiment ```kotlin WebAuthProvider.login(account) .withParameters(mapOf( "experiment_id" to "", "variation_id" to "", - "segment_id" to "" + "segment_id" to "" // optional )) .start(this, callback) ``` @@ -61,7 +26,7 @@ WebAuthProvider.login(account) .withParameters(mapOf( "experiment_id" to "", "variation_id" to "", - "segment_id" to "" + "segment_id" to "" // optional )) .await(this) ``` @@ -76,7 +41,7 @@ WebAuthProvider.login(account) .withParameters(new HashMap() {{ put("experiment_id", ""); put("variation_id", ""); - put("segment_id", ""); + put("segment_id", ""); // optional }}) .start(this, callback); ``` @@ -84,6 +49,6 @@ WebAuthProvider.login(account) > [!NOTE] -> Experiment Center is an Enterprise feature. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions. +> Experiment Center is currently in Beta and runs only on **development tenants**. Production tenants are not supported during the Beta period. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions. > > Only `WebAuthProvider` login reaches Experiment Center. Embedded/native login and ROPG skip `/authorize` entirely and do not support experiment overrides. From aae9962fdaa720548e7c636c6ee8e76f6cf68639 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Fri, 25 Sep 2026 11:07:02 +0530 Subject: [PATCH 5/9] docs: use Early Access tag for Experiment Center --- README.md | 6 ++++-- examples/experiment-center.md | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index b84c00226..e6fc96e82 100644 --- a/README.md +++ b/README.md @@ -318,6 +318,9 @@ WebAuthProvider.login(account) ### Experiment Center +> [!NOTE] +> Experiment Center support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative. + [Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. Pass `experiment_id`, `variation_id`, and optionally `segment_id` via `withParameters()` to force a specific variation on a Web Auth login request: ```kotlin @@ -330,8 +333,7 @@ WebAuthProvider.login(account) .start(this, callback) ``` -> [!NOTE] -> Experiment Center is currently in Beta and runs only on development tenants. See the [full usage example](examples/experiment-center.md) for coroutine and Java samples. +See the [full usage example](examples/experiment-center.md) for coroutine and Java samples. ## Credentials Manager diff --git a/examples/experiment-center.md b/examples/experiment-center.md index aa42c726d..2096ef9eb 100644 --- a/examples/experiment-center.md +++ b/examples/experiment-center.md @@ -49,6 +49,6 @@ WebAuthProvider.login(account) > [!NOTE] -> Experiment Center is currently in Beta and runs only on **development tenants**. Production tenants are not supported during the Beta period. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions. +> Experiment Center is an Enterprise feature, and support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions. > > Only `WebAuthProvider` login reaches Experiment Center. Embedded/native login and ROPG skip `/authorize` entirely and do not support experiment overrides. From a32bdb97cbc5b4ca4b6a63f323e7b5a2c9afeb7c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 15:33:57 +0530 Subject: [PATCH 6/9] chore(deps): bump the codeql group with 3 updates (#1077) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d0746e617..0f1be80fd 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,15 +45,15 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{ matrix.language }}" From e423368455517f7b18e2cb72f56da29d05404792 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Wed, 7 Oct 2026 10:47:05 +0530 Subject: [PATCH 7/9] CI(synk):fix(deps): update netty-codec-http to 4.1.137.Final --- build.gradle | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/build.gradle b/build.gradle index 7f94c35eb..ddc8486b8 100644 --- a/build.gradle +++ b/build.gradle @@ -42,4 +42,14 @@ allprojects { google() mavenCentral() } + + // Patch transitive netty-codec-http to clear Snyk. Pulled in by AGP's + // test tooling (grpc-netty); not included in the published AAR. + configurations.configureEach { + resolutionStrategy.eachDependency { details -> + if (details.requested.group == 'io.netty' && details.requested.name == 'netty-codec-http') { + details.useVersion '4.1.137.Final' + } + } + } } From ac3fba3c9566c8642706bab5bd5af9109fce1acb Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Wed, 7 Oct 2026 10:56:56 +0530 Subject: [PATCH 8/9] CI(synk):update bcprov-jdk18on to 1.85 --- build.gradle | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/build.gradle b/build.gradle index 7f94c35eb..e3c61379f 100644 --- a/build.gradle +++ b/build.gradle @@ -42,4 +42,14 @@ allprojects { google() mavenCentral() } + + // Patch transitive bcprov-jdk18on to clear the reported CVEs. Pulled in by Robolectric + // (testImplementation); not included in the published AAR. + configurations.configureEach { + resolutionStrategy.eachDependency { details -> + if (details.requested.group == 'org.bouncycastle' && details.requested.name == 'bcprov-jdk18on') { + details.useVersion '1.85' + } + } + } } From c53af001a2856235eee266db5bf02141e3a519ef Mon Sep 17 00:00:00 2001 From: Prince Mathew Date: Wed, 7 Oct 2026 12:19:19 +0530 Subject: [PATCH 9/9] chore: add merge drivers to keep v5 .version/README and union CHANGELOG Co-Authored-By: Claude --- .gitattributes | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.gitattributes b/.gitattributes index 168718f98..24d0ad166 100644 --- a/.gitattributes +++ b/.gitattributes @@ -4,4 +4,11 @@ # Isolate binary files in case the auto-detection algorithm fails and # marks them as text files (which could brick them). -*.{png,jpg,jpeg,gif,webp,woff,woff2} binary \ No newline at end of file +*.{png,jpg,jpeg,gif,webp,woff,woff2} binary + +# Keep this branch's own copy of these files when syncing main into v5. +# `.version` and README carry v5-specific content, so always keep ours. +.version merge=ours +README.md merge=ours +# CHANGELOG gets release entries from main AND beta entries here — keep both. +CHANGELOG.md merge=union \ No newline at end of file