Thanks, Albert, and sorry for the confusion. app.example.com was a placeholder: I anonymized the domain, team ID and bundle IDs in the post, and example.com is a reserved domain, which is why the CDN reports SWCERR00202. The real domain is app.digisign.org: $ curl -i https://app-site-association.cdn-apple.com/a/v1/app.digisign.org HTTP/1.1 200 OK Content-Type: application/json {"webcredentials":{"apps":["33F646XBSF.com.ds.digisign.internal","33F646XBSF.com.ds.digisign.dev","33F646XBSF.com.ds.digisign"]}}The origin https://app.digisign.org/.well-known/apple-app-site-association serves the same JSON (200, application/json, no redirect). The values from my previous reply, unmasked: Native test app: bundle ID com.ds.digisign.dev, team 33F646XBSF, entitlement webcredentials:app.digisign.org, development signing. After installation swcd approved the webcredentials entry for app.digisign.org. SMS last line: @app.digisign.org #123456 WKWebView page origin: https://app.digisign.org Our App Store app (com.ds.digisign) fails the same way on iOS 27.0.

Thanks, Albert. CDN: yes, the AASA is on the CDN. https://app-site-association.cdn-apple.com/a/v1/app.example.com returns the same JSON as the domain, and after installation swcd approves the webcredentials entry for that domain. Flutter: to rule it out, we built a minimal native app and tested it on the same iPhone (iOS 27.0): new Xcode project, SwiftUI, no third-party code the bundle ID of our development build, signed with the team's development profile entitlement webcredentials:app.example.com a UITextField with textContentType = .oneTimeCode a WKWebView with <input autocomplete="one-time-code"> on a page whose origin is https://app.example.com SMS sent from another phone: Your verification code is: 123456 @app.example.com #123456The code is not offered in either field. Keyboard log for the native UITextField: kbd Received verification code from Messages kbd Current verification code is domain-bound to <mask.hash: 'D'>. kbd Checking domain against associated domains for app <mask.hash: 'A'>. kbd Domain-bound verification code is NOT valid for app <mask.hash: 'A'>. kbd Returning 0 available one-time codesThe WKWebView field logs the same lines, plus Could not fetch application record for application identifier: <mask.hash: 'A'> before the domain check. So the lookup error is not the cause: the native field has no lookup error, and the domain check still fails. Executable name: we built the same native app again with PRODUCT_NAME = Runner (so CFBundleExecutable = Runner) and changed nothing else. It fails the same way, and the masked application identifier is identical to the first build's. So the identifier does not come from the executable name. Summary: on iOS 27.0, a native app without third-party code, whose webcredentials association swcd has approved, is not offered a domain-bound SMS code for that domain. This happens in a native field and in a WKWebView. The same SMS is offered in Safari on the same device, and the same setup worked on iOS 26.6 and iOS 18. Why the SMS carries the domain: we add the @app.example.com #123456 line on purpose, to follow the origin-bound one-time code format (also used by the WebOTP API). It lets browsers and associated apps fill the code, and only on the right domain, which protects against phishing. Dropping the line makes the code appear in our app again on iOS 27, but it also drops that binding to the domain. We would rather keep the standard format and have it work in the associated app, as it did before iOS 27. Can you confirm whether this is a regression in iOS 27, or a new requirement that apps have to meet?