breaking: removed the deprecated MFA APIs

[pmathew92]

• Review PR changes for removing deprecated MFA APIs from AuthenticationAPIClient
• Remove unused MFA_PATH constant left after removing multifactorChallenge
• Improve migration guide with pointer to new MfaApiClient and EXAMPLES.md
• Code review passed with no issues
• Security scan passed

[pmathew92]

@copilot review this PR

[Copilot]

@copilot review this PR

Reviewed the PR. The changes look good overall — the deprecated MFA methods have been cleanly removed from AuthenticationAPIClient, tests removed, and documentation updated.

Two small issues found and fixed in commit 18e8fcc:

1. Unused MFA_PATH constant — After removing multifactorChallenge, the private const val MFA_PATH = "mfa" constant in AuthenticationAPIClient was left behind with no remaining usages. Removed it.

2. Migration guide lacked migration path — The V4_MIGRATION_GUIDE.md section listed the removed methods but didn't tell users how to migrate. Added a pointer to AuthenticationAPIClient.mfaClient(mfaToken) and the EXAMPLES.md#mfa-flexible-factors-grant section.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx2048m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.11.1-bin/bpt9gzteqjrbo1mjrsomdt32c/gradle-8.11.1/lib/gradle-daemon-main-8.11.1.jar (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Removes the legacy/deprecated MFA convenience methods from AuthenticationAPIClient (breaking change) and updates developer-facing docs to point consumers to the newer MfaApiClient APIs.

Changes:

• Removed deprecated MFA methods (loginWithOTP, loginWithOOB, loginWithRecoveryCode, multifactorChallenge) and related constants/imports from AuthenticationAPIClient.
• Removed corresponding unit tests and outdated MFA OTP example documentation.
• Updated v4 migration guide and Challenge KDoc to reference MfaApiClient and the newer MFA examples.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
V4_MIGRATION_GUIDE.md	Adds a v4 breaking-change note describing the removed deprecated MFA methods and where to migrate.
EXAMPLES.md	Removes the old MFA OTP example section; leaves the newer “MFA Flexible Factors Grant” section as the recommended approach.
auth0/src/test/java/com/auth0/android/authentication/AuthenticationAPIClientTest.kt	Deletes tests that exercised the removed deprecated MFA methods.
auth0/src/main/java/com/auth0/android/result/Challenge.kt	Updates KDoc reference away from the removed AuthenticationAPIClient.multifactorChallenge.
auth0/src/main/java/com/auth0/android/authentication/AuthenticationAPIClient.kt	Removes deprecated MFA methods and the now-unused MFA_PATH/related constants/imports.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.