Since iOS 27.0, domain-bound SMS one-time codes are no longer offered above the keyboard in our app, where the code is entered on a web page in a WKWebView, although the app is associated with the domain through webcredentials. The same SMS is offered in Safari on the same device, and it is offered in our app on iOS 26.6 and iOS 18.
SMS format (last line per the domain-bound code format):
Your verification code is: 123456
@app.example.com #123456Setup
Several builds of the same app with different bundle IDs (App Store, internal, development), all under one team
Entitlement com.apple.developer.associated-domains: webcredentials:app.example.com (plus two more environments of the same domain)
AASA at https://app.example.com/.well-known/apple-app-site-association: 200, application/json, no redirect, same content on app-site-association.cdn-apple.com:
{"webcredentials":{"apps":["TEAMID.com.example.app","TEAMID.com.example.app.internal","TEAMID.com.example.app.dev"]}}
The code field is an <input type="tel" autocomplete="one-time-code"> in a WKWebView showing a page on that domain. We also tested a native field with the one-time-code content type (the app is built with Flutter; the field is a Flutter TextField with the one-time-code autofill hint).
Steps
Open the verification page in the app and focus the code field.
Receive the SMS above.
Expected: the code is offered in the QuickType bar, as it is in Safari on the same domain and as it is in our app on iOS 26.6 and iOS 18.
Actual: nothing is offered. The keyboard log:
kbd Received verification code from Messages
kbd One Time Code field has been entered.
kbd Retrieving Current One-Time Codes for App
kbd Current verification code is domain-bound to <mask.hash: '…'>.
kbd Domain-bound verification code is NOT valid for app <mask.hash: 'X'>.
E kbd Could not fetch application record for application identifier: <mask.hash: 'X'>.
kbd Returning 0 available one-time codesWhat we checked
swcd downloads the AASA for all domains without errors after a reinstall.
The installed app's entitlements (read from the device) contain the expected application-identifier and associated domains; the profile is validated.
The failure is the same in the WKWebView field and in a native one-time-code field, in the App Store build, a distribution-signed internal build and a development build, and in an older app version that used to work.
The masked application identifier in the log (X above) is the same for two builds with different bundle IDs, so the lookup does not seem to use the app's bundle ID. All our builds share CFBundleExecutable = Runner (the Flutter default) and the same CFBundleName.
The same app build and the same SMS work on iOS 26.6 and iOS 18.x, so the change happened between iOS 26.6 and 27.0.
An SMS without the @domain #code line is offered in the app on iOS 27 (Returning 1 available one-time code), although Could not fetch application record is still logged.
Questions
Is this a known iOS 27 regression, or is there a new requirement for apps to receive domain-bound codes?
What application identifier does the keyboard use for this lookup, and can anything in the app's configuration (for example the executable name) affect it?
Device: iPhone 17 Pro Max, iOS 27.0