chore: bring v5.11.0 changes into v6-development

.version

@@ -1 +1 @@
-v5.10.0
+v5.11.0

A0Auth0.podspec

@@ -16,7 +16,7 @@ Pod::Spec.new do |s|
   s.source_files = 'ios/**/*.{h,m,mm,swift}'
   s.requires_arc = true
 
-  s.dependency 'Auth0', '2.23.0'
+  s.dependency 'Auth0', '2.24.1'
   s.dependency 'SimpleKeychain', '1.3.0'
 
   install_modules_dependencies(s)

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Change Log
 
+## [v5.11.0](https://github.com/auth0/react-native-auth0/tree/v5.11.0) (2026-07-31)
+
+[Full Changelog](https://github.com/auth0/react-native-auth0/compare/v5.10.0...v5.11.0)
+
+**Added**
+
+- feat: enforce IPSIE session_expiry with a SESSION_EXPIRED error [\#1597](https://github.com/auth0/react-native-auth0/pull/1597) ([subhankarmaiti](https://github.com/subhankarmaiti))
+- feat: add passkeys support for web [\#1604](https://github.com/auth0/react-native-auth0/pull/1604) ([NandanPrabhu](https://github.com/NandanPrabhu))
+- feat: add My Account API support on the web platform [\#1608](https://github.com/auth0/react-native-auth0/pull/1608) ([subhankarmaiti](https://github.com/subhankarmaiti))
+- feat: add actor token support for Custom Token Exchange impersonation & delegation [\#1595](https://github.com/auth0/react-native-auth0/pull/1595) ([subhankarmaiti](https://github.com/subhankarmaiti))
+- feat: add INVALID_CALLBACK_URL web auth error code [\#1603](https://github.com/auth0/react-native-auth0/pull/1603) ([subhankarmaiti](https://github.com/subhankarmaiti))
+
 ## [v5.10.0](https://github.com/auth0/react-native-auth0/tree/v5.10.0) (2026-07-17)
 
 [Full Changelog](https://github.com/auth0/react-native-auth0/compare/v5.9.0...v5.10.0)

CLAUDE.md

@@ -27,7 +27,7 @@ Apply these on every task in this repo — they keep changes correct, small, and
 - **Tech Stack:** React Native (New Architecture / TurboModules), iOS (Swift + ObjC++), Android (Kotlin), web (auth0-spa-js)
 - **Package Manager:** Yarn (Berry, `.yarnrc.yml`); Node pinned via `.nvmrc` (v22.15.0)
 - **Minimum Platform Version:** React Native ≥ 0.78.0, React ≥ 19.0.0 (peer deps); iOS/Android minimums come from the native SDKs
-- **Dependencies:** `@auth0/auth0-spa-js` 2.19.3, `jwt-decode` 4, `base-64`, `url` · test: Jest 29 + `fetch-mock`, `@testing-library/react`. See `package.json` for the authoritative list.
+- **Dependencies:** `@auth0/auth0-spa-js` 2.24.0, `jwt-decode` 4, `base-64`, `url` · test: Jest 29 + `fetch-mock`, `@testing-library/react`. See `package.json` for the authoritative list.
 
 ---
 

EXAMPLES-WEB.md

@@ -201,7 +201,7 @@ function MfaScreen({ mfaToken }: { mfaToken: string }) {
   const verifyOtp = async () => {
     try {
       const credentials = await mfa.verify({ mfaToken, otp });
-      console.log('Authenticated!', credentials.accessToken);
+      console.log('Authenticated!');
     } catch (error) {
       if (error instanceof MfaError) {
         switch (error.type) {
@@ -277,6 +277,63 @@ const credentials = await auth0.mfa.verify({
 });
 ```
 
+## 4. Passkeys (Web)
+
+Passkeys are supported on web via `@auth0/auth0-spa-js`. The flow is the same three steps as native (challenge → WebAuthn ceremony → exchange), but step 2 uses the browser's built-in [WebAuthn API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) (`navigator.credentials.create()`/`.get()`) instead of a native module — the app calls it directly, the SDK does not perform this step for you. `getTokenByPasskey`'s `authResponse` accepts the raw `PublicKeyCredential` returned by `navigator.credentials` directly on web — no manual serialization needed (unlike native, which takes a JSON string; see [Signup with Passkey (Web)](./EXAMPLES.md#signup-with-passkey-web) in `EXAMPLES.md` for the full signup example).
+
+**Secure context requirement:** `navigator.credentials.create()`/`.get()` only work over HTTPS (or `localhost` for local development). Apps served over plain HTTP will fail at the WebAuthn ceremony with a `SecurityError`.
+
+Because `navigator.credentials.create()`/`.get()` require a user gesture, call `passkeySignupChallenge` / `passkeyLoginChallenge` from within a click handler (not, for example, from a `useEffect`).
+
+```tsx
+import { useAuth0, PasskeyError } from 'react-native-auth0';
+
+function PasskeyLoginButton() {
+  const { passkeyLoginChallenge, getTokenByPasskey } = useAuth0();
+
+  const handleLogin = async () => {
+    try {
+      const challenge = await passkeyLoginChallenge({
+        realm: 'Username-Password-Authentication',
+      });
+
+      // App calls navigator.credentials directly (not wrapped by SDK)
+      const credential = (await navigator.credentials.get({
+        publicKey:
+          challenge.authParamsPublicKey as PublicKeyCredentialRequestOptions,
+      })) as PublicKeyCredential | null;
+
+      if (!credential) {
+        // User cancelled or no credential available
+        throw new Error('No passkey credential returned');
+      }
+
+      const credentials = await getTokenByPasskey({
+        authSession: challenge.authSession,
+        authResponse: credential,
+        realm: 'Username-Password-Authentication',
+      });
+
+      console.log('Signed in with passkey');
+    } catch (error) {
+      if (error instanceof PasskeyError) {
+        console.error('Passkey login failed:', error.type, error.message);
+
+        // Handle MFA required scenario
+        const mfaPayload = error.getMfaRequiredPayload();
+        if (mfaPayload) {
+          console.log('MFA required. Token:', mfaPayload.mfaToken);
+          console.log('Available factors:', mfaPayload.mfaRequirements);
+          // Continue with mfa.challenge() and mfa.verify()
+        }
+      }
+    }
+  };
+
+  return <button onClick={handleLogin}>Sign In with Passkey</button>;
+}
+```
+
 ## Web Platform Notes
 
 The web platform supports direct authentication grants including `auth.passwordRealm()`, `auth.createUser()`, `auth.resetPassword()`, and the MFA Flexible Factors Grant. These methods make direct HTTP calls to the Auth0 API.