Salesforce is enforcing phishing-resistant multi-factor authentication (MFA) for privileged users. Under that policy, a passkey, a built-in authenticator (Face ID, Touch ID, Windows Hello), or a physical security key replaces the 6-digit code from an authenticator app. Enforcement is rolling out in phases during 2026, so your org's date depends on your Salesforce instance.
Versions of the Mobile Check-in app before Build 1.4.6 cannot complete a passkey sign-in on the standard login screen. Build 1.4.6 was released on 8 September 2026 and resolves this. This page explains what you will see, how to get the fix, and how to set your org up if you cannot update yet.
Who this affects
Users whose only registered Salesforce MFA method is a passkey, a built-in authenticator, or a security key. In practice this is users with administrative permissions, which Salesforce determines from the profile, permission set, or permission set group assigned to the user, not only from the System Administrator profile.
What you will see
When you try to log in with a passkey as your only MFA method:
The Log In with a Passkey button does nothing when tapped.
Salesforce may show an error saying no built-in authenticators are available and suggesting you try Safari.
The 6-digit code entry screen never appears, so there is no way to fall back to a code, even if you register an authenticator app afterward.
Why this happens
The app's login screen runs inside an in-app browser view provided by the Salesforce Mobile SDK. That view cannot run a passkey (WebAuthn) ceremony, so Face ID, Touch ID, and security keys have nothing to respond to.
This is a Salesforce platform limitation, not a Blackthorn defect or a misconfiguration in your org. The same behavior occurs in the official Salesforce mobile app, and Salesforce documents it in Built-In Authenticators (Passkeys) for MFA. Salesforce's own guidance for apps on Mobile SDK 13.2.0 and earlier is the My Domain setup described below.
Set up My Domain so passkey login works today
Do this before your users register passkeys
Salesforce recommends enabling native-browser login before users register a passkey. If a user registers a passkey first, they can be locked out of the app, and recovering requires reinstalling the app or clearing its data on the device.
These two steps make the app hand the passkey step off to your phone's real browser, where Face ID or Touch ID can complete normally. No change to anyone's permissions is required.
Step 1 — A Salesforce administrator enables native-browser login (one time, per org).
In Salesforce Setup, search for and open My Domain.
Under Authentication Configuration, click Edit.
Select Use the native browser for user authentication on iOS. Select the equivalent Android option if your team uses Android devices.
Click Save.
Still on the My Domain page, copy your Current My Domain URL. It looks like
https://yourcompany.my.salesforce.com.
Step 2 — Each user points the app at the My Domain URL.
Open the Mobile Check-in app. On the Salesforce login screen, tap the gear icon in the top-right corner.
Choose to add a connection or change the server, and enter the My Domain URL from Step 1.
Save the connection and select it, then enter your username.
The app opens your device browser for login, prompts for your passkey (Face ID or Touch ID), and returns you to the app signed in.
Use the My Domain URL, not the generic login address
This only works when the app is pointed at your ...my.salesforce.com address. If the app is set to login.salesforce.com or test.salesforce.com, it falls back to the in-app browser view and the passkey will not work.
If login still fails
Confirm the My Domain setting was saved, and that the app is connected to the My Domain URL rather than the generic login address.
If the user already registered their passkey before the My Domain setting was enabled, they may be in the locked-out state Salesforce describes. Delete and reinstall the app, or clear the app's data on the device, then repeat Step 2.
Open a case with Blackthorn Support and reference passkey login on the Mobile Check-in app.
Permanent fix: shipped in Build 1.4.6
Salesforce added a browser-based Login for Admin option in Mobile SDK 13.2.1. It forces the browser-based login flow instead of the in-app browser view, which is what allows a passkey sign-in to complete.
Blackthorn has upgraded the Mobile Check-in app to that SDK version on both iOS and Android. This shipped in Build 1.4.6 on 8 September 2026, on both iOS and Android. In that build:
A Login for Admin option appears on the login screen.
Users with a passkey as their only MFA method can log in without pointing the app at a My Domain URL first.
Existing logins with an authenticator app continue to work unchanged.
The update arrives through the App Store and Google Play, so make sure your devices are set to update the app or install it manually. Note that Build 1.4.6 requires iOS 17 or later, because the newer Salesforce Mobile SDK does. An iPhone or iPad still on iOS 16 will not receive it and will need an OS update first. Android is unchanged and still supports Android 9 and later.
This is not the same as Biometric Authentication in the app
The Mobile Check-in app's Biometric Authentication feature uses Face ID or Touch ID to unlock the app after you are already signed in. That feature works normally. The limitation on this page applies only to the Salesforce login and MFA step.
FAQ
Q: Does this mean administrators cannot use the Mobile Check-in app?
A: No. The constraint is about how the login screen handles a passkey, not about permission level. Administrators can sign in today using the My Domain setup above.
Q: Can I just register an authenticator app instead?
A: Only if your user is not covered by phishing-resistant MFA enforcement. The app accepts a typed 6-digit code without any issue, but once enforcement applies to a user, Salesforce itself stops accepting codes from authenticator apps for that user, so a code is no longer a valid way in.
Q: Will a password manager that stores my one-time codes work?
A: If it produces a numeric code you type in, the app accepts it, subject to the enforcement caveat above. If it presents a passkey instead of a code, use the My Domain setup on this page.
Q: We use single sign-on. Are we affected?
A: It depends on your identity provider. If your provider verifies you with a password and a code, login works as it does today. If it verifies you with a passkey or device biometrics, the same in-app browser limitation applies, and the My Domain setup on this page is the fix. Note that Salesforce also requires your identity provider to signal that a phishing-resistant method was used, so single sign-on on its own does not satisfy the new policy.
Q: Is this a Blackthorn bug?
A: No. It is a Salesforce Mobile SDK limitation that affects the official Salesforce mobile app the same way. Build 1.4.6 picks up the newer SDK that resolves it.