2FA passcode SMS uses domain-bound codes for reliable autofill
Shipped 2026-06-29
The 2FA passcode SMS now appends an Apple domain-bound code line
(@www.tunnelflight.com #<code>) as its final line, and the website serves the
matching Apple App Site Association (AASA) file. Combined with the mobile app’s
new Associated Domains entitlement, this pins iOS QuickType autofill to the
exact current passcode so it can no longer surface a stale code from an earlier
message in the thread — the root cause of members entering the wrong code.
-
Code generation, storage, expiry, and validation are unchanged — only the SMS body gains the trailing domain-bound line.
-
Uses
www.tunnelflight.com, not the apex: the apex 301-redirects to www and Apple does not follow redirects when fetching the association file. -
GET /.well-known/apple-app-site-associationnow returns{"webcredentials":{"apps":["QV957DP83B.com.app.iba"]}}asapplication/json. -
Ship order matters: the app build carrying the Associated Domains entitlement must be live before this deploys, or domain-bound codes are offered to an app that isn’t yet associated. (The 1.0.7 build is already on TestFlight/Play.)
-
Jira: TNBUGS-1732