Since iOS 27.0, domain-bound SMS one-time codes are no longer offered above the keyboard in our app, where the code is entered on a web page in a WKWebView, although the app is associated with the domain through webcredentials. The same SMS is offered in Safari on the same device, and it is offered in our app on iOS 26.6 and iOS 18.
SMS format (last line per the domain-bound code format):
Your verification code is: 123456
@app.example.com #123456
Setup
- Several builds of the same app with different bundle IDs (App Store, internal, development), all under one team
- Entitlement
com.apple.developer.associated-domains:webcredentials:app.example.com(plus two more environments of the same domain) - AASA at
https://app.example.com/.well-known/apple-app-site-association: 200,application/json, no redirect, same content onapp-site-association.cdn-apple.com:{"webcredentials":{"apps":["TEAMID.com.example.app","TEAMID.com.example.app.internal","TEAMID.com.example.app.dev"]}} - The code field is an
<input type="tel" autocomplete="one-time-code">in aWKWebViewshowing a page on that domain. We also tested a native field with the one-time-code content type (the app is built with Flutter; the field is a FlutterTextFieldwith the one-time-code autofill hint).
Steps
- Open the verification page in the app and focus the code field.
- Receive the SMS above.
Expected: the code is offered in the QuickType bar, as it is in Safari on the same domain and as it is in our app on iOS 26.6 and iOS 18.
Actual: nothing is offered. The keyboard log:
kbd Received verification code from Messages
kbd One Time Code field has been entered.
kbd Retrieving Current One-Time Codes for App
kbd Current verification code is domain-bound to <mask.hash: '…'>.
kbd Domain-bound verification code is NOT valid for app <mask.hash: 'X'>.
E kbd Could not fetch application record for application identifier: <mask.hash: 'X'>.
kbd Returning 0 available one-time codes
What we checked
swcddownloads the AASA for all domains without errors after a reinstall.- The installed app's entitlements (read from the device) contain the expected
application-identifierand associated domains; the profile is validated. - The failure is the same in the
WKWebViewfield and in a native one-time-code field, in the App Store build, a distribution-signed internal build and a development build, and in an older app version that used to work. - The masked application identifier in the log (
Xabove) is the same for two builds with different bundle IDs, so the lookup does not seem to use the app's bundle ID. All our builds shareCFBundleExecutable = Runner(the Flutter default) and the sameCFBundleName. - The same app build and the same SMS work on iOS 26.6 and iOS 18.x, so the change happened between iOS 26.6 and 27.0.
- An SMS without the
@domain #codeline is offered in the app on iOS 27 (Returning 1 available one-time code), althoughCould not fetch application recordis still logged.
Questions
- Is this a known iOS 27 regression, or is there a new requirement for apps to receive domain-bound codes?
- What application identifier does the keyboard use for this lookup, and can anything in the app's configuration (for example the executable name) affect it?
Device: iPhone 17 Pro Max, iOS 27.0
