Bccorb · Oct 21, 2026 · Oct 21, 2026
diff --git a/.changeset/contact-emails-fellscode.md b/.changeset/contact-emails-fellscode.md
diff --git a/.changeset/oauth-state-binding.md b/.changeset/oauth-state-binding.md
diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @seamless-auth/client
 
+## 0.7.1
+
+### Patch Changes
+
+- f21867d: OAuth sign-in now carries the state binding the auth server returns from `POST /oauth/:providerId/start` back to the callback. The session actions `startOAuthLogin` and `finishOAuthLogin` (and so `useAuth()` in React and React Native, and the Angular, Vue and Svelte bindings) store the binding with its state, attach it to the matching callback, and clear it afterwards, so apps that call these actions directly need no code change. The binding is kept in `sessionStorage` under `seamless:oauth:binding` in a browser and in memory elsewhere, and is never sent to the provider or put in a URL. `startOAuthSignIn` passes it explicitly when an in-app browser hands the callback back, and now refuses a callback whose state is not the one it started.
+
+  `StartOAuthLoginResult` gains an optional `binding` and `FinishOAuthLoginInput` an optional `binding`. Older auth servers return no binding and are unaffected. Auth API 0.19.x with fells-code/seamless-auth-api#463 refuses a callback without the binding, so upgrade this SDK before or with that API release.
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/client/package.json b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/client",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Framework-agnostic client core for Seamless Auth: the HTTP client, session store, and result types the framework bindings share.",
   "type": "module",
   "exports": {

diff --git a/packages/react-native/CHANGELOG.md b/packages/react-native/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @seamless-auth/react-native
 
+## 0.3.3
+
+### Patch Changes
+
+- f21867d: OAuth sign-in now carries the state binding the auth server returns from `POST /oauth/:providerId/start` back to the callback. The session actions `startOAuthLogin` and `finishOAuthLogin` (and so `useAuth()` in React and React Native, and the Angular, Vue and Svelte bindings) store the binding with its state, attach it to the matching callback, and clear it afterwards, so apps that call these actions directly need no code change. The binding is kept in `sessionStorage` under `seamless:oauth:binding` in a browser and in memory elsewhere, and is never sent to the provider or put in a URL. `startOAuthSignIn` passes it explicitly when an in-app browser hands the callback back, and now refuses a callback whose state is not the one it started.
+
+  `StartOAuthLoginResult` gains an optional `binding` and `FinishOAuthLoginInput` an optional `binding`. Older auth servers return no binding and are unaffected. Auth API 0.19.x with fells-code/seamless-auth-api#463 refuses a callback without the binding, so upgrade this SDK before or with that API release.
+
+- Updated dependencies [f21867d]
+  - @seamless-auth/client@0.7.1
+
 ## 0.3.2
 
 ### Patch Changes

diff --git a/packages/react-native/package.json b/packages/react-native/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react-native",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.",
   "type": "module",
   "exports": {
@@ -45,7 +45,7 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.7.0",
+    "@seamless-auth/client": "^0.7.1",
     "@seamless-auth/types": "^0.29.0"
   },
   "sideEffects": false

diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @seamless-auth/react
 
+## 0.18.1
+
+### Patch Changes
+
+- 15ed347: The SMS terms modal now lists `support@fellscode.com` as the opt-out and support contact.
+- f21867d: OAuth sign-in now carries the state binding the auth server returns from `POST /oauth/:providerId/start` back to the callback. The session actions `startOAuthLogin` and `finishOAuthLogin` (and so `useAuth()` in React and React Native, and the Angular, Vue and Svelte bindings) store the binding with its state, attach it to the matching callback, and clear it afterwards, so apps that call these actions directly need no code change. The binding is kept in `sessionStorage` under `seamless:oauth:binding` in a browser and in memory elsewhere, and is never sent to the provider or put in a URL. `startOAuthSignIn` passes it explicitly when an in-app browser hands the callback back, and now refuses a callback whose state is not the one it started.
+
+  `StartOAuthLoginResult` gains an optional `binding` and `FinishOAuthLoginInput` an optional `binding`. Older auth servers return no binding and are unaffected. Auth API 0.19.x with fells-code/seamless-auth-api#463 refuses a callback without the binding, so upgrade this SDK before or with that API release.
+
+- Updated dependencies [f21867d]
+  - @seamless-auth/client@0.7.1
+
 ## 0.18.0
 
 ### Minor Changes

diff --git a/packages/react/package.json b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "A drop-in authentication solution for modern React applications.",
   "type": "module",
   "exports": {
@@ -56,7 +56,7 @@
     }
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.7.0",
+    "@seamless-auth/client": "^0.7.1",
     "@seamless-auth/types": "^0.29.0",
     "@simplewebauthn/browser": "^13.1.0",
     "libphonenumber-js": "^1.12.7"