feat: native app links for passkeys (#12580)

# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>

console/src/app/pages/projects/apps/app-detail/app-detail.component.html

@@ -462,6 +462,102 @@
             </div>
           </cnsl-card>
         }
+
+        @if (currentSetting.id === 'native-app-links' && oidcForm && app?.oidcConfig) {
+          <cnsl-card title="{{ 'APP.OIDC.APPLINKSSECTION' | translate }}">
+            <p class="app-desc cnsl-secondary-text">{{ 'APP.OIDC.APPLINKSDESC' | translate }}</p>
+            <form [formGroup]="oidcForm" (ngSubmit)="saveOIDCApp()">
+              <h3 class="title">{{ 'APP.OIDC.IOSTITLE' | translate }}</h3>
+              <cnsl-info-section class="full-width app-desc">
+                <span>{{ 'APP.OIDC.IOSDESC' | translate }}</span>
+                @if (issuer$ | async; as issuer) {
+                  <div class="link app-link-endpoint">
+                    <a [href]="issuer + '/.well-known/apple-app-site-association'" rel="noreferrer" target="_blank"
+                      >{{ issuer }}/.well-known/apple-app-site-association</a
+                    >
+                  </div>
+                }
+              </cnsl-info-section>
+              <div class="content">
+                <cnsl-form-field class="app-formfield">
+                  <cnsl-label>{{ 'APP.OIDC.TEAMID' | translate }}</cnsl-label>
+                  <input
+                    cnslInput
+                    formControlName="iosTeamId"
+                    maxlength="10"
+                    autocomplete="off"
+                    [placeholder]="'APP.OIDC.TEAMIDPLACEHOLDER' | translate"
+                  />
+                </cnsl-form-field>
+                <cnsl-form-field class="app-formfield">
+                  <cnsl-label>{{ 'APP.OIDC.BUNDLEID' | translate }}</cnsl-label>
+                  <input
+                    cnslInput
+                    formControlName="iosBundleId"
+                    autocomplete="off"
+                    [placeholder]="'APP.OIDC.BUNDLEIDPLACEHOLDER' | translate"
+                  />
+                </cnsl-form-field>
+              </div>
+              <cnsl-info-section class="full-width app-desc">
+                <span>{{ 'APP.OIDC.TEAMIDDESC' | translate }} {{ 'APP.OIDC.BUNDLEIDDESC' | translate }}</span>
+              </cnsl-info-section>
+              @if (showIosAppLinkIncompleteWarning()) {
+                <cnsl-info-section class="full-width app-desc" [type]="InfoSectionType.WARN">
+                  <span>{{ 'APP.OIDC.IOSAPPLINKINCOMPLETE' | translate }}</span>
+                </cnsl-info-section>
+              }
+
+              <h3 class="title" style="margin-top: 1.5rem">{{ 'APP.OIDC.ANDROIDTITLE' | translate }}</h3>
+              <cnsl-info-section class="full-width app-desc">
+                <span>{{ 'APP.OIDC.ANDROIDDESC' | translate }}</span>
+                @if (issuer$ | async; as issuer) {
+                  <div class="link app-link-endpoint">
+                    <a [href]="issuer + '/.well-known/assetlinks.json'" rel="noreferrer" target="_blank"
+                      >{{ issuer }}/.well-known/assetlinks.json</a
+                    >
+                  </div>
+                }
+              </cnsl-info-section>
+              <div class="content">
+                <cnsl-form-field class="app-formfield full-width">
+                  <cnsl-label>{{ 'APP.OIDC.PACKAGENAME' | translate }}</cnsl-label>
+                  <input
+                    cnslInput
+                    formControlName="androidPackageName"
+                    autocomplete="off"
+                    [placeholder]="'APP.OIDC.PACKAGENAMEPLACEHOLDER' | translate"
+                  />
+                </cnsl-form-field>
+                <cnsl-form-field class="app-formfield full-width fingerprints-field">
+                  <cnsl-label>{{ 'APP.OIDC.FINGERPRINTS' | translate }}</cnsl-label>
+                  <textarea
+                    cnslInput
+                    class="fingerprints-input"
+                    formControlName="androidSha256CertFingerprints"
+                    rows="10"
+                    [placeholder]="'APP.OIDC.FINGERPRINTSPLACEHOLDER' | translate"
+                  ></textarea>
+                </cnsl-form-field>
+              </div>
+              <cnsl-info-section class="full-width app-desc">
+                <span>{{ 'APP.OIDC.FINGERPRINTSDESC' | translate }}</span>
+              </cnsl-info-section>
+              @if (showAndroidPackageRequiredWarning()) {
+                <cnsl-info-section class="full-width app-desc" [type]="InfoSectionType.WARN">
+                  <span>{{ 'APP.OIDC.ANDROIDPACKAGEREQUIRED' | translate }}</span>
+                </cnsl-info-section>
+              }
+
+              <div class="btn-container">
+                <button class="submit-button" type="submit" color="primary" [disabled]="!canWrite" mat-raised-button>
+                  {{ 'ACTIONS.SAVE' | translate }}
+                </button>
+              </div>
+            </form>
+          </cnsl-card>
+        }
+
         @if (currentSetting.id === 'urls') {
           <cnsl-card title=" {{ 'APP.URLS' | translate }}">
             @if (issuer$ | async; as issuer) {

console/src/app/pages/projects/apps/app-detail/app-detail.component.scss

@@ -53,6 +53,11 @@
   .app-desc {
     font-size: 14px;
     margin: 0;
+
+    .app-link-endpoint {
+      margin-top: 0.5rem;
+      word-break: break-all;
+    }
   }
 
   .app-input {
@@ -281,6 +286,17 @@
     input {
       max-width: none;
     }
+
+    textarea.fingerprints-input,
+    .fingerprints-input {
+      max-width: none;
+      width: 100%;
+      min-height: 12rem;
+      resize: vertical;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New', monospace;
+      font-size: 0.875rem;
+      line-height: 1.4;
+    }
   }
 }
 

console/src/app/pages/projects/apps/app-detail/app-detail.component.ts

@@ -1,7 +1,16 @@
 import { COMMA, ENTER, SPACE } from '@angular/cdk/keycodes';
 import { Location } from '@angular/common';
 import { Component, OnDestroy, OnInit, signal } from '@angular/core';
-import { AbstractControl, FormControl, UntypedFormBuilder, UntypedFormControl, UntypedFormGroup } from '@angular/forms';
+import {
+  AbstractControl,
+  FormControl,
+  UntypedFormBuilder,
+  UntypedFormControl,
+  UntypedFormGroup,
+  ValidationErrors,
+  ValidatorFn,
+  Validators,
+} from '@angular/forms';
 import { MatCheckboxChange } from '@angular/material/checkbox';
 import { MatDialog } from '@angular/material/dialog';
 import { ActivatedRoute, Router } from '@angular/router';
@@ -206,18 +215,25 @@ export class AppDetailComponent implements OnInit, OnDestroy {
     private router: Router,
     private breadcrumbService: BreadcrumbService,
   ) {
-    this.oidcForm = this.fb.group({
-      devMode: [{ value: false, disabled: true }],
-      skipNativeAppSuccessPage: [{ value: false, disabled: true }],
-      clientId: [{ value: '', disabled: true }],
-      responseTypesList: [{ value: [], disabled: true }],
-      grantTypesList: [{ value: [], disabled: true }],
-      appType: [{ value: '', disabled: true }],
-      authMethodType: [{ value: '', disabled: true }],
-      loginV2: [{ value: false, disabled: true }],
-      loginV2BaseURL: [{ value: '', disabled: true }],
-      backChannelLogoutURI: [{ value: '', disabled: true }],
-    });
+    this.oidcForm = this.fb.group(
+      {
+        devMode: [{ value: false, disabled: true }],
+        skipNativeAppSuccessPage: [{ value: false, disabled: true }],
+        clientId: [{ value: '', disabled: true }],
+        responseTypesList: [{ value: [], disabled: true }],
+        grantTypesList: [{ value: [], disabled: true }],
+        appType: [{ value: '', disabled: true }],
+        authMethodType: [{ value: '', disabled: true }],
+        loginV2: [{ value: false, disabled: true }],
+        loginV2BaseURL: [{ value: '', disabled: true }],
+        backChannelLogoutURI: [{ value: '', disabled: true }],
+        iosTeamId: [{ value: '', disabled: true }, [iosTeamIdValidator]],
+        iosBundleId: [{ value: '', disabled: true }, [Validators.maxLength(200)]],
+        androidPackageName: [{ value: '', disabled: true }, [Validators.maxLength(200)]],
+        androidSha256CertFingerprints: [{ value: '', disabled: true }],
+      },
+      { validators: [appLinkConfigValidator()] },
+    );
 
     this.oidcTokenForm = this.fb.group({
       accessTokenType: [{ value: '', disabled: true }],
@@ -375,6 +391,7 @@ export class AppDetailComponent implements OnInit, OnDestroy {
                   this.settingsList = [
                     { id: 'configuration', i18nKey: 'APP.CONFIGURATION' },
                     { id: 'token', i18nKey: 'APP.TOKEN' },
+                    { id: 'native-app-links', i18nKey: 'APP.OIDC.APPLINKSSECTION' },
                     { id: 'urls', i18nKey: 'APP.URLS' },
                   ];
                 } else {
@@ -383,6 +400,7 @@ export class AppDetailComponent implements OnInit, OnDestroy {
                     { id: 'token', i18nKey: 'APP.TOKEN' },
                     { id: 'redirect-uris', i18nKey: 'APP.OIDC.REDIRECTSECTIONTITLE' },
                     { id: 'additional-origins', i18nKey: 'APP.ADDITIONALORIGINS' },
+                    { id: 'native-app-links', i18nKey: 'APP.OIDC.APPLINKSSECTION' },
                     { id: 'urls', i18nKey: 'APP.URLS' },
                   ];
                 }
@@ -465,6 +483,12 @@ export class AppDetailComponent implements OnInit, OnDestroy {
               if (this.app.oidcConfig) {
                 this.oidcForm.patchValue(this.app.oidcConfig);
                 this.oidcTokenForm.patchValue(this.app.oidcConfig);
+                this.oidcForm.controls['iosTeamId'].setValue(this.app.oidcConfig.ios?.teamId ?? '');
+                this.oidcForm.controls['iosBundleId'].setValue(this.app.oidcConfig.ios?.bundleId ?? '');
+                this.oidcForm.controls['androidPackageName'].setValue(this.app.oidcConfig.android?.packageName ?? '');
+                this.oidcForm.controls['androidSha256CertFingerprints'].setValue(
+                  (this.app.oidcConfig.android?.sha256CertFingerprintsList ?? []).join('\n'),
+                );
               }
               if (this.app.apiConfig) {
                 this.apiForm.patchValue(this.app.apiConfig);
@@ -657,96 +681,106 @@ export class AppDetailComponent implements OnInit, OnDestroy {
 
   public saveOIDCApp(): void {
     this.requestRedirectValuesSubject$.next();
-    if (this.oidcForm.valid) {
-      if (this.app?.oidcConfig) {
-        //   configuration
-        this.app.oidcConfig.responseTypesList = this.responseTypesList?.value;
-        this.app.oidcConfig.grantTypesList = this.grantTypesList?.value;
-        this.app.oidcConfig.appType = this.appType?.value;
-        this.app.oidcConfig.authMethodType = this.authMethodType?.value;
-        this.app.oidcConfig.backChannelLogoutUri = this.backChannelLogoutURI?.value;
+    if (!this.oidcForm.valid) {
+      this.markNativeAppLinkFieldsTouched();
+      return;
+    }
+    if (this.app?.oidcConfig) {
+      //   configuration
+      this.app.oidcConfig.responseTypesList = this.responseTypesList?.value;
+      this.app.oidcConfig.grantTypesList = this.grantTypesList?.value;
+      this.app.oidcConfig.appType = this.appType?.value;
+      this.app.oidcConfig.authMethodType = this.authMethodType?.value;
+      this.app.oidcConfig.backChannelLogoutUri = this.backChannelLogoutURI?.value;
 
-        // token
-        this.app.oidcConfig.accessTokenType = this.accessTokenType?.value;
-        this.app.oidcConfig.accessTokenRoleAssertion = this.accessTokenRoleAssertion?.value;
-        this.app.oidcConfig.idTokenRoleAssertion = this.idTokenRoleAssertion?.value;
-        this.app.oidcConfig.idTokenUserinfoAssertion = this.idTokenUserinfoAssertion?.value;
+      // token
+      this.app.oidcConfig.accessTokenType = this.accessTokenType?.value;
+      this.app.oidcConfig.accessTokenRoleAssertion = this.accessTokenRoleAssertion?.value;
+      this.app.oidcConfig.idTokenRoleAssertion = this.idTokenRoleAssertion?.value;
+      this.app.oidcConfig.idTokenUserinfoAssertion = this.idTokenUserinfoAssertion?.value;
 
-        // redirects
-        this.app.oidcConfig.redirectUrisList = this.redirectUrisList;
-        this.app.oidcConfig.postLogoutRedirectUrisList = this.postLogoutRedirectUrisList;
-        this.app.oidcConfig.additionalOriginsList = this.additionalOriginsList;
-        this.app.oidcConfig.devMode = !!this.devMode?.value;
-        this.app.oidcConfig.skipNativeAppSuccessPage = !!this.skipNativeAppSuccessPage?.value;
+      // redirects
+      this.app.oidcConfig.redirectUrisList = this.redirectUrisList;
+      this.app.oidcConfig.postLogoutRedirectUrisList = this.postLogoutRedirectUrisList;
+      this.app.oidcConfig.additionalOriginsList = this.additionalOriginsList;
+      this.app.oidcConfig.devMode = !!this.devMode?.value;
+      this.app.oidcConfig.skipNativeAppSuccessPage = !!this.skipNativeAppSuccessPage?.value;
 
-        const loginVersion: MessageInitShape<typeof LoginVersionSchema> = this.oidcLoginV2?.value
-          ? {
-              version: {
-                case: 'loginV2',
-                value: { baseUri: this.oidcLoginV2BaseURL?.value },
-              },
-            }
-          : {
-              version: {
-                case: 'loginV1',
-                value: {},
-              },
-            };
-
-        const req: MessageInitShape<typeof UpdateApplicationRequestSchema> = {
-          projectId: this.projectId,
-          applicationId: this.app.id,
-          applicationType: {
-            case: 'oidcConfiguration',
-            value: {
-              // configuration
-              responseTypes: this.app.oidcConfig.responseTypesList.map((type) => this.toOIDCV2ResponseType(type)),
-              authMethodType: this.app.oidcConfig.authMethodType as unknown as OIDCV2AuthMethodType,
-              grantTypes: this.app.oidcConfig.grantTypesList as unknown as OIDCV2GrantType[],
-              applicationType: this.app.oidcConfig.appType as unknown as OIDCV2ApplicationType,
-              backChannelLogoutUri: this.app.oidcConfig.backChannelLogoutUri,
-              loginVersion,
-
-              // token
-              accessTokenType: this.app.oidcConfig.accessTokenType as unknown as OIDCV2TokenType,
-              accessTokenRoleAssertion: this.app.oidcConfig.accessTokenRoleAssertion,
-              idTokenRoleAssertion: this.app.oidcConfig.idTokenRoleAssertion,
-              idTokenUserinfoAssertion: this.app.oidcConfig.idTokenUserinfoAssertion,
-
-              // redirects
-              redirectUris: this.normalizeOIDCListForUpdate(this.app.oidcConfig.redirectUrisList),
-              additionalOrigins: this.app.oidcConfig.additionalOriginsList,
-              postLogoutRedirectUris: this.normalizeOIDCListForUpdate(this.app.oidcConfig.postLogoutRedirectUrisList),
-              developmentMode: this.app.oidcConfig.devMode,
-              skipNativeAppSuccessPage: this.app.oidcConfig.skipNativeAppSuccessPage,
-              ...(this.clockSkewSeconds?.value
-                ? {
-                    clockSkew: {
-                      seconds: BigInt(Math.floor(this.clockSkewSeconds?.value)),
-                      nanos: Math.floor(this.clockSkewSeconds?.value % 1) * 10000,
-                    },
-                  }
-                : {}),
+      const loginVersion: MessageInitShape<typeof LoginVersionSchema> = this.oidcLoginV2?.value
+        ? {
+            version: {
+              case: 'loginV2',
+              value: { baseUri: this.oidcLoginV2BaseURL?.value },
             },
-          },
-        };
+          }
+        : {
+            version: {
+              case: 'loginV1',
+              value: {},
+            },
+          };
 
-        this.applicationService
-          .updateApplication(req)
-          .then(() => {
-            if (this.app?.oidcConfig) {
-              const config = { oidc: this.app.oidcConfig };
-              this.currentAuthMethod = this.authMethodFromPartialConfig(config);
-            }
-            this.toast.showInfo('APP.TOAST.OIDCUPDATED', true);
-            setTimeout(() => {
-              this.getData(this.projectId, this.appId);
-            }, 1000);
-          })
-          .catch((error) => {
-            this.toast.showError(error);
-          });
-      }
+      const req: MessageInitShape<typeof UpdateApplicationRequestSchema> = {
+        projectId: this.projectId,
+        applicationId: this.app.id,
+        applicationType: {
+          case: 'oidcConfiguration',
+          value: {
+            // configuration
+            responseTypes: this.app.oidcConfig.responseTypesList.map((type) => this.toOIDCV2ResponseType(type)),
+            authMethodType: this.app.oidcConfig.authMethodType as unknown as OIDCV2AuthMethodType,
+            grantTypes: this.app.oidcConfig.grantTypesList as unknown as OIDCV2GrantType[],
+            applicationType: this.app.oidcConfig.appType as unknown as OIDCV2ApplicationType,
+            backChannelLogoutUri: this.app.oidcConfig.backChannelLogoutUri,
+            loginVersion,
+
+            // token
+            accessTokenType: this.app.oidcConfig.accessTokenType as unknown as OIDCV2TokenType,
+            accessTokenRoleAssertion: this.app.oidcConfig.accessTokenRoleAssertion,
+            idTokenRoleAssertion: this.app.oidcConfig.idTokenRoleAssertion,
+            idTokenUserinfoAssertion: this.app.oidcConfig.idTokenUserinfoAssertion,
+
+            // redirects
+            redirectUris: this.normalizeOIDCListForUpdate(this.app.oidcConfig.redirectUrisList),
+            additionalOrigins: this.app.oidcConfig.additionalOriginsList,
+            postLogoutRedirectUris: this.normalizeOIDCListForUpdate(this.app.oidcConfig.postLogoutRedirectUrisList),
+            developmentMode: this.app.oidcConfig.devMode,
+            skipNativeAppSuccessPage: this.app.oidcConfig.skipNativeAppSuccessPage,
+            ios: {
+              teamId: (this.iosTeamId?.value ?? '').trim(),
+              bundleId: (this.iosBundleId?.value ?? '').trim(),
+            },
+            android: {
+              packageName: (this.androidPackageName?.value ?? '').trim(),
+              sha256CertFingerprints: this.parseAndroidFingerprints(this.androidSha256CertFingerprints?.value),
+            },
+            ...(this.clockSkewSeconds?.value
+              ? {
+                  clockSkew: {
+                    seconds: BigInt(Math.floor(this.clockSkewSeconds?.value)),
+                    nanos: Math.floor(this.clockSkewSeconds?.value % 1) * 10000,
+                  },
+                }
+              : {}),
+          },
+        },
+      };
+
+      this.applicationService
+        .updateApplication(req)
+        .then(() => {
+          if (this.app?.oidcConfig) {
+            const config = { oidc: this.app.oidcConfig };
+            this.currentAuthMethod = this.authMethodFromPartialConfig(config);
+          }
+          this.toast.showInfo('APP.TOAST.OIDCUPDATED', true);
+          setTimeout(() => {
+            this.getData(this.projectId, this.appId);
+          }, 1000);
+        })
+        .catch((error) => {
+          this.toast.showError(error);
+        });
     }
   }
 
@@ -754,6 +788,16 @@ export class AppDetailComponent implements OnInit, OnDestroy {
     return values.length === 0 ? [''] : values;
   }
 
+  private parseAndroidFingerprints(value: unknown): string[] {
+    if (typeof value !== 'string' || !value.trim()) {
+      return [];
+    }
+    return value
+      .split(/[\n,]+/)
+      .map((fp) => fp.trim())
+      .filter((fp) => fp.length > 0);
+  }
+
   private toOIDCV2ResponseType(type: OIDCResponseType): OIDCV2ResponseType {
     switch (type) {
       case OIDCResponseType.OIDC_RESPONSE_TYPE_CODE:
@@ -943,6 +987,49 @@ export class AppDetailComponent implements OnInit, OnDestroy {
     return this.oidcForm.get('skipNativeAppSuccessPage') as FormControl<boolean>;
   }
 
+  public get iosTeamId(): AbstractControl | null {
+    return this.oidcForm.get('iosTeamId');
+  }
+
+  public get iosBundleId(): AbstractControl | null {
+    return this.oidcForm.get('iosBundleId');
+  }
+
+  public get androidPackageName(): AbstractControl | null {
+    return this.oidcForm.get('androidPackageName');
+  }
+
+  public get androidSha256CertFingerprints(): AbstractControl | null {
+    return this.oidcForm.get('androidSha256CertFingerprints');
+  }
+
+  /** Defer cross-field warnings until the user has visited the paired empty field. */
+  public showIosAppLinkIncompleteWarning(): boolean {
+    if (!this.oidcForm.hasError('iosAppLinkIncomplete')) {
+      return false;
+    }
+    const teamId = String(this.iosTeamId?.value ?? '').trim();
+    const bundleId = String(this.iosBundleId?.value ?? '').trim();
+    if (teamId !== '' && bundleId === '') {
+      return !!this.iosBundleId?.touched;
+    }
+    if (bundleId !== '' && teamId === '') {
+      return !!this.iosTeamId?.touched;
+    }
+    return false;
+  }
+
+  public showAndroidPackageRequiredWarning(): boolean {
+    return this.oidcForm.hasError('androidAppLinkPackageRequired') && !!this.androidPackageName?.touched;
+  }
+
+  private markNativeAppLinkFieldsTouched(): void {
+    this.iosTeamId?.markAsTouched();
+    this.iosBundleId?.markAsTouched();
+    this.androidPackageName?.markAsTouched();
+    this.androidSha256CertFingerprints?.markAsTouched();
+  }
+
   public get accessTokenType(): AbstractControl | null {
     return this.oidcTokenForm.get('accessTokenType');
   }
@@ -1006,3 +1093,49 @@ export class AppDetailComponent implements OnInit, OnDestroy {
     }
   }
 }
+
+function iosTeamIdValidator(c: AbstractControl): ValidationErrors | null {
+  const value = String(c.value ?? '').trim();
+  if (value === '') {
+    return null;
+  }
+  if (!/^[A-Z0-9]+$/.test(value)) {
+    return {
+      invalid: true,
+      errorsinvalidformat: { valid: false, i18nKey: 'ERRORS.INVALID_FORMAT' },
+    };
+  }
+  if (value.length !== 10) {
+    return {
+      invalid: true,
+      errorsapoidcteamidlength: { valid: false, i18nKey: 'APP.OIDC.TEAMIDLENGTH' },
+    };
+  }
+  return null;
+}
+
+/** Mirrors backend AppLinkConfigValid: iOS fields together; package required when fingerprints are set. */
+function appLinkConfigValidator(): ValidatorFn {
+  return (group: AbstractControl): ValidationErrors | null => {
+    const teamId = String(group.get('iosTeamId')?.value ?? '').trim();
+    const bundleId = String(group.get('iosBundleId')?.value ?? '').trim();
+    const packageName = String(group.get('androidPackageName')?.value ?? '').trim();
+    const fingerprintsRaw = group.get('androidSha256CertFingerprints')?.value;
+    const fingerprints =
+      typeof fingerprintsRaw === 'string'
+        ? fingerprintsRaw
+            .split(/[\n,]+/)
+            .map((fp) => fp.trim())
+            .filter((fp) => fp.length > 0)
+        : [];
+
+    const errors: ValidationErrors = {};
+    if ((teamId === '') !== (bundleId === '')) {
+      errors['iosAppLinkIncomplete'] = true;
+    }
+    if (fingerprints.length > 0 && packageName === '') {
+      errors['androidAppLinkPackageRequired'] = true;
+    }
+    return Object.keys(errors).length ? errors : null;
+  };
+}

console/src/assets/i18n/ar.json

@@ -2610,6 +2610,25 @@
       "DEVMODEDESC": "احذر: مع تمكين وضع التطوير، لن يتم التحقق من عناوين URI لإعادة التوجيه.",
       "SKIPNATIVEAPPSUCCESSPAGE": "تخطي صفحة نجاح تسجيل الدخول",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "تخطي صفحة النجاح بعد تسجيل الدخول لهذا التطبيق الأصلي.",
+      "APPLINKSSECTION": "روابط التطبيقات الأصلية",
+      "APPLINKSDESC": "قم بتهيئة ارتباط iOS وAndroid حتى تتمكن هذه المثيلة من تقديم ملفات الثقة بـ Passkey لتطبيقاتك الأصلية.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "تُقدَّم في apple-app-site-association كمدخل webcredentials بالصيغة TEAMID.BUNDLEID.",
+      "TEAMID": "معرّف الفريق",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "يجب أن يكون Apple Team ID مكونًا من 10 أحرف أبجدية رقمية بالضبط، مثل ABCDE12345.",
+      "TEAMIDLENGTH": "يجب أن يكون Team ID مكونًا من 10 أحرف أبجدية رقمية بالضبط.",
+      "BUNDLEID": "معرّف الحزمة",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "معرّف حزمة iOS (CFBundleIdentifier)، مثل com.example.app. لا تُدرج بادئة Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "تُقدَّم في assetlinks.json لبيانات اعتماد Passkey عبر Digital Asset Links.",
+      "PACKAGENAME": "اسم الحزمة",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "معرّف تطبيق Android / اسم الحزمة (applicationId)، مثل com.example.app.",
+      "FINGERPRINTS": "بصمات شهادة SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "بصمة واحدة لكل سطر (64 حرفًا سادس عشريًا، النقطتان اختياريتان). أدرج إصداري التصحيح والإصدار حسب الحاجة.",
       "REDIRECT": "عناوين URI لإعادة التوجيه",
       "REDIRECTSECTION": "عناوين URI لإعادة التوجيه",
       "POSTLOGOUTREDIRECT": "عناوين URI بعد تسجيل الخروج",
@@ -2673,7 +2692,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "عنوان URI لتسجيل الخروج من القناة الخلفية"
+      "BACKCHANNELLOOGOUTURI": "عنوان URI لتسجيل الخروج من القناة الخلفية",
+      "IOSAPPLINKINCOMPLETE": "يجب تعيين معرّف فريق iOS ومعرّف الحزمة معًا، أو تركهما فارغين معًا.",
+      "ANDROIDPACKAGEREQUIRED": "اسم حزمة Android مطلوب عند تعيين بصمات شهادة."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/bg.json

@@ -2618,6 +2618,25 @@
       "DEVMODEDESC": "Внимание: При активиран режим на разработка URI адресите за пренасочване няма да бъдат валидирани.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Пропуснете страницата за успешно влизане",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Пропуснете страницата за успех след влизане в това родно приложение.",
+      "APPLINKSSECTION": "Връзки за нативни приложения",
+      "APPLINKSDESC": "Конфигурирайте iOS и Android асоциации, за да може тази инстанция да предоставя trust файлове за passkeys на вашите нативни приложения.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Предоставя се в apple-app-site-association като webcredentials запис TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID трябва да е точно 10 буквено-цифрови знака, напр. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID трябва да е точно 10 буквено-цифрови знака.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), напр. com.example.app. Не включвайте префикса Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Предоставя се в assetlinks.json за Digital Asset Links / passkey credentials.",
+      "PACKAGENAME": "Име на пакета",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / име на пакет, напр. com.example.app.",
+      "FINGERPRINTS": "SHA-256 сертификатни отпечатъци",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Един отпечатък на ред (64 шестнадесетични знака, двоеточията са по избор). Добавете debug и release при нужда.",
       "REDIRECT": "Пренасочване на URI",
       "REDIRECTSECTION": "Пренасочване на URI",
       "POSTLOGOUTREDIRECT": "Публикувайте URI адреси за излизане",
@@ -2681,7 +2700,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID и Bundle ID трябва да бъдат зададени заедно или и двете да останат празни.",
+      "ANDROIDPACKAGEREQUIRED": "Името на Android пакета е задължително, когато са зададени сертификатни пръстови отпечатъци."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/cs.json

@@ -2600,6 +2600,25 @@
       "DEVMODEDESC": "Pozor: S povoleným vývojovým režimem nebudou URI pro přesměrování ověřovány.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Přeskočit stránku úspěchu přihlášení",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Přeskočit stránku úspěchu po přihlášení pro tuto nativní aplikaci.",
+      "APPLINKSSECTION": "Odkazy pro nativní aplikace",
+      "APPLINKSDESC": "Nakonfigurujte asociaci iOS a Android, aby tato instance mohla poskytovat trust soubory pro passkeys vašich nativních aplikací.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Poskytováno v apple-app-site-association jako webcredentials položka TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID musí mít přesně 10 alfanumerických znaků, např. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID musí mít přesně 10 alfanumerických znaků.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), např. com.example.app. Nezahrnujte prefix Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Poskytováno v assetlinks.json pro Digital Asset Links / passkey credentials.",
+      "PACKAGENAME": "Název balíčku",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / název balíčku, např. com.example.app.",
+      "FINGERPRINTS": "SHA-256 otisky certifikátů",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Jeden otisk na řádek (64 hexadecimálních znaků, dvojtečky volitelně). Podle potřeby uveďte debug i release.",
       "REDIRECT": "URI pro přesměrování",
       "REDIRECTSECTION": "URI pro přesměrování",
       "POSTLOGOUTREDIRECT": "URI po odhlášení",
@@ -2663,7 +2682,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID a Bundle ID musí být nastaveny společně, nebo obě ponechány prázdné.",
+      "ANDROIDPACKAGEREQUIRED": "Název balíčku Android je povinný, pokud jsou nastaveny otisky certifikátu."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/de.json

@@ -2591,6 +2591,25 @@
       "DEVMODEDESC": "Bei eingeschaltetem Entwicklermodus werden die Weiterleitungs-URIs im OIDC-Flow nicht validiert.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Login Erfolgseite überspringen",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Erfolgseite nach dem Login für diese Native Applikation überspringen.",
+      "APPLINKSSECTION": "Native App Links",
+      "APPLINKSDESC": "Konfigurieren Sie iOS- und Android-Zuordnungen, damit diese Instanz Passkey-Trust-Dateien für Ihre nativen Apps bereitstellen kann.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Wird in apple-app-site-association als webcredentials-Eintrag TEAMID.BUNDLEID ausgeliefert.",
+      "TEAMID": "Team-ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team-ID muss genau 10 alphanumerische Zeichen haben, z. B. ABCDE12345.",
+      "TEAMIDLENGTH": "Team-ID muss genau 10 alphanumerische Zeichen haben.",
+      "BUNDLEID": "Bundle-ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), z. B. com.example.app. Ohne Team-ID-Präfix.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Wird in assetlinks.json für Digital Asset Links / Passkey-Credentials ausgeliefert.",
+      "PACKAGENAME": "Package Name",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / Package Name, z. B. com.example.app.",
+      "FINGERPRINTS": "SHA-256 Zertifikatsfingerabdrücke",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Ein Fingerabdruck pro Zeile (64 Hex-Zeichen, Doppelpunkte optional). Debug und Release bei Bedarf angeben.",
       "REDIRECT": "Weiterleitungs-URIs",
       "REDIRECTSECTION": "Weiterleitungs-URIs",
       "POSTLOGOUTREDIRECT": "URIs für Post-Log-out",
@@ -2654,7 +2673,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID und Bundle ID müssen beide gesetzt oder beide leer sein.",
+      "ANDROIDPACKAGEREQUIRED": "Android-Paketname ist erforderlich, wenn Zertifikat-Fingerprints gesetzt sind."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/en.json

@@ -2622,6 +2622,27 @@
       "DEVMODEDESC": "Beware: With development mode enabled redirect URIs will not be validated.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Skip Login Success Page",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Skip the success page after a login for this native app.",
+      "APPLINKSSECTION": "Native App Links",
+      "APPLINKSDESC": "Configure iOS and Android association so this instance can serve passkey trust files for your native apps.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Served in apple-app-site-association as a webcredentials entry TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID must be exactly 10 alphanumeric characters, e.g. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID must be exactly 10 alphanumeric characters.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), e.g. com.example.app. Do not include the Team ID prefix.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Served in assetlinks.json for Digital Asset Links / passkey credentials.",
+      "PACKAGENAME": "Package Name",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / package name, e.g. com.example.app.",
+      "FINGERPRINTS": "SHA-256 Certificate Fingerprints",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "One fingerprint per line (64 hex characters, optional colons). Include debug and release as needed.",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID and Bundle ID must both be set, or both left empty.",
+      "ANDROIDPACKAGEREQUIRED": "Android package name is required when certificate fingerprints are set.",
       "REDIRECT": "Redirect URIs",
       "REDIRECTSECTION": "Redirect URIs",
       "POSTLOGOUTREDIRECT": "Post Logout URIs",

console/src/assets/i18n/es.json

@@ -2588,6 +2588,25 @@
       "DEVMODEDESC": "Cuidado: Si el modo de desarrollo está activado las URIs de redirección no serán validadas.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Saltar página de inicio de sesión con éxito",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Sáltate la página de éxito después de iniciar sesión en esta app nativa.",
+      "APPLINKSSECTION": "Enlaces de aplicaciones nativas",
+      "APPLINKSDESC": "Configure la asociación de iOS y Android para que esta instancia pueda servir archivos de confianza de passkeys para sus aplicaciones nativas.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Se sirve en apple-app-site-association como entrada webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "El Apple Team ID debe tener exactamente 10 caracteres alfanuméricos, p. ej. ABCDE12345.",
+      "TEAMIDLENGTH": "El Team ID debe tener exactamente 10 caracteres alfanuméricos.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "Identificador de paquete de iOS (CFBundleIdentifier), p. ej. com.example.app. No incluya el prefijo del Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Se sirve en assetlinks.json para Digital Asset Links / credenciales de passkey.",
+      "PACKAGENAME": "Nombre del paquete",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "applicationId / nombre del paquete de Android, p. ej. com.example.app.",
+      "FINGERPRINTS": "Huellas SHA-256 del certificado",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Una huella por línea (64 caracteres hexadecimales, los dos puntos son opcionales). Incluya debug y release según sea necesario.",
       "REDIRECT": "URIs de redirección",
       "REDIRECTSECTION": "URIs de redirección",
       "POSTLOGOUTREDIRECT": "URIs a usar tras cerrar sesión",
@@ -2651,7 +2670,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "El Team ID y el Bundle ID de iOS deben estar ambos configurados, o ambos vacíos.",
+      "ANDROIDPACKAGEREQUIRED": "El nombre del paquete de Android es obligatorio cuando se definen huellas de certificado."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/fr.json

@@ -2592,6 +2592,25 @@
       "DEVMODEDESC": "Attention",
       "SKIPNATIVEAPPSUCCESSPAGE": "Sauter la page de succès de connexion",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Sauter la page de succès après la connexion pour cette application native",
+      "APPLINKSSECTION": "Liens d'applications natives",
+      "APPLINKSDESC": "Configurez l'association iOS et Android afin que cette instance puisse servir les fichiers de confiance passkey pour vos applications natives.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Servi dans apple-app-site-association comme entrée webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "L'Apple Team ID doit comporter exactement 10 caractères alphanumériques, p. ex. ABCDE12345.",
+      "TEAMIDLENGTH": "L'ID d'équipe doit comporter exactement 10 caractères alphanumériques.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "Identifiant de bundle iOS (CFBundleIdentifier), p. ex. com.example.app. N'incluez pas le préfixe Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Servi dans assetlinks.json pour Digital Asset Links / identifiants passkey.",
+      "PACKAGENAME": "Nom du package",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "applicationId / nom de package Android, p. ex. com.example.app.",
+      "FINGERPRINTS": "Empreintes de certificat SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Une empreinte par ligne (64 caractères hexadécimaux, deux-points optionnels). Incluez debug et release si nécessaire.",
       "REDIRECT": "Rediriger les URIs",
       "REDIRECTSECTION": "URIs de redirection",
       "POSTLOGOUTREDIRECT": "URIs de post-déconnexion",
@@ -2655,7 +2674,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "L'ID d'équipe iOS et le Bundle ID doivent tous deux être renseignés, ou tous deux laissés vides.",
+      "ANDROIDPACKAGEREQUIRED": "Le nom de package Android est requis lorsque des empreintes de certificat sont définies."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/hu.json

@@ -2620,6 +2620,25 @@
       "DEVMODEDESC": "Figyelem: Ha a fejlesztői mód be van kapcsolva, a redirect URI-k nem lesznek érvényesítve.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Login sikeroldal kihagyása",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Hagyd ki a sikeroldalt a bejelentkezés után ennél a helyi alkalmazásnál.",
+      "APPLINKSSECTION": "Natív alkalmazáshivatkozások",
+      "APPLINKSDESC": "Állítsa be az iOS és Android társítást, hogy ez a példány passkey trust fájlokat szolgálhasson ki a natív alkalmazásaihoz.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Az apple-app-site-association fájlban webcredentials bejegyzésként jelenik meg: TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Az Apple Team ID pontosan 10 alfanumerikus karakterből álljon, pl. ABCDE12345.",
+      "TEAMIDLENGTH": "A Team ID pontosan 10 alfanumerikus karakterből álljon.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), pl. com.example.app. Ne tartalmazza a Team ID előtagot.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Az assetlinks.json fájlban Digital Asset Links / passkey hitelesítő adatokhoz szolgál.",
+      "PACKAGENAME": "Csomagnév",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / csomagnév, pl. com.example.app.",
+      "FINGERPRINTS": "SHA-256 tanúsítvány ujjlenyomatok",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Soronként egy ujjlenyomat (64 hexadecimális karakter, a kettőspontok opcionálisak). Szükség szerint adja meg a debug és release értékeket.",
       "REDIRECT": "Redirect URIs",
       "REDIRECTSECTION": "Redirect URIs",
       "POSTLOGOUTREDIRECT": "Kijelentkezés utáni URIs",
@@ -2683,7 +2702,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "Az iOS Team ID-t és Bundle ID-t együtt kell megadni, vagy mindkettőt üresen hagyni.",
+      "ANDROIDPACKAGEREQUIRED": "Android csomagnév kötelező, ha tanúsítvány ujjlenyomatok vannak megadva."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/id.json

@@ -2614,6 +2614,25 @@
       "DEVMODEDESC": "Hati-hati: Dengan mengaktifkan mode pengembangan, URI pengalihan tidak akan divalidasi.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Lewati Halaman Sukses Login",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Lewati halaman sukses setelah login untuk aplikasi asli ini.",
+      "APPLINKSSECTION": "Tautan Aplikasi Native",
+      "APPLINKSDESC": "Konfigurasikan asosiasi iOS dan Android agar instance ini dapat menyajikan file kepercayaan passkey untuk aplikasi native Anda.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Disajikan di apple-app-site-association sebagai entri webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID harus tepat 10 karakter alfanumerik, mis. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID harus tepat 10 karakter alfanumerik.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), mis. com.example.app. Jangan sertakan awalan Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Disajikan di assetlinks.json untuk Digital Asset Links / kredensial passkey.",
+      "PACKAGENAME": "Nama Paket",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / nama paket, mis. com.example.app.",
+      "FINGERPRINTS": "Sidik Jari Sertifikat SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Satu sidik jari per baris (64 karakter heksadesimal, titik dua opsional). Sertakan debug dan release sesuai kebutuhan.",
       "REDIRECT": "Arahkan ulang URI",
       "REDIRECTSECTION": "Arahkan ulang URI",
       "POSTLOGOUTREDIRECT": "URI Posting Logout",
@@ -2677,7 +2696,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "Team ID dan Bundle ID iOS harus keduanya diisi, atau keduanya dikosongkan.",
+      "ANDROIDPACKAGEREQUIRED": "Nama paket Android wajib diisi bila sidik jari sertifikat diatur."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/it.json

@@ -2592,6 +2592,25 @@
       "DEVMODEDESC": "Attenzione: Con la modalità di sviluppo abilitata, gli URI di reindirizzamento non saranno convalidati.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Salta la pagina di successo dopo il login",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Salta la pagina di successo dopo il login per questa applicazione nativa",
+      "APPLINKSSECTION": "Collegamenti app native",
+      "APPLINKSDESC": "Configura l'associazione iOS e Android in modo che questa istanza possa fornire i file di trust passkey per le tue app native.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Fornito in apple-app-site-association come voce webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "L'Apple Team ID deve contenere esattamente 10 caratteri alfanumerici, ad es. ABCDE12345.",
+      "TEAMIDLENGTH": "Il Team ID deve contenere esattamente 10 caratteri alfanumerici.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "Bundle Identifier iOS (CFBundleIdentifier), ad es. com.example.app. Non includere il prefisso Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Fornito in assetlinks.json per Digital Asset Links / credenziali passkey.",
+      "PACKAGENAME": "Nome del package",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "applicationId / nome del package Android, ad es. com.example.app.",
+      "FINGERPRINTS": "Impronte del certificato SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Un'impronta per riga (64 caratteri esadecimali, i due punti sono opzionali). Includere debug e release se necessario.",
       "REDIRECT": "URI per il reindrizzamento",
       "REDIRECTSECTION": "Reindirizzamento",
       "POSTLOGOUTREDIRECT": "URI post logout",
@@ -2655,7 +2674,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "Team ID e Bundle ID iOS devono essere entrambi impostati oppure entrambi vuoti.",
+      "ANDROIDPACKAGEREQUIRED": "Il nome del package Android è obbligatorio quando sono impostate le impronte del certificato."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/ja.json

@@ -2617,6 +2617,25 @@
       "DEVMODEDESC": "注意：開発モードを有効にすると、URIが認証されません。",
       "SKIPNATIVEAPPSUCCESSPAGE": "ログイン後に成功ページをスキップする",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "このネイティブアプリのログイン後に成功ページをスキップする",
+      "APPLINKSSECTION": "ネイティブアプリリンク",
+      "APPLINKSDESC": "このインスタンスがネイティブアプリ向けのパスキー信頼ファイルを提供できるよう、iOS / Android の関連付けを設定します。",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "apple-app-site-association の webcredentials エントリ TEAMID.BUNDLEID として提供されます。",
+      "TEAMID": "チーム ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID は英数字ちょうど 10 文字である必要があります（例: ABCDE12345）。",
+      "TEAMIDLENGTH": "Team ID は英数字ちょうど 10 文字である必要があります。",
+      "BUNDLEID": "バンドル ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS の Bundle Identifier（CFBundleIdentifier）、例: com.example.app。Team ID プレフィックスは含めないでください。",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Digital Asset Links / パスキー認証情報用に assetlinks.json で提供されます。",
+      "PACKAGENAME": "パッケージ名",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android の applicationId / パッケージ名、例: com.example.app。",
+      "FINGERPRINTS": "SHA-256 証明書フィンガープリント",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "1 行に 1 つ（16 進 64 文字、コロンは任意）。必要に応じてデバッグ用とリリース用を含めてください。",
       "REDIRECT": "リダイレクトURI",
       "REDIRECTSECTION": "リダイレクトURI",
       "POSTLOGOUTREDIRECT": "ログアウトURI",
@@ -2680,7 +2699,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "バックチャネルログアウトURI"
+      "BACKCHANNELLOOGOUTURI": "バックチャネルログアウトURI",
+      "IOSAPPLINKINCOMPLETE": "iOS の Team ID と Bundle ID は両方設定するか、両方とも空にしてください。",
+      "ANDROIDPACKAGEREQUIRED": "証明書フィンガープリントを設定する場合、Android パッケージ名は必須です。"
     },
     "API": {
       "INFO": {

console/src/assets/i18n/ko.json

@@ -2616,6 +2616,25 @@
       "DEVMODEDESC": "주의: 개발 모드가 활성화된 경우 리디렉션 URI가 검증되지 않습니다.",
       "SKIPNATIVEAPPSUCCESSPAGE": "로그인 성공 페이지 건너뛰기",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "네이티브 앱 로그인 후 성공 페이지를 건너뜁니다.",
+      "APPLINKSSECTION": "네이티브 앱 링크",
+      "APPLINKSDESC": "이 인스턴스가 네이티브 앱용 패스키 신뢰 파일을 제공할 수 있도록 iOS 및 Android 연결을 구성합니다.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "apple-app-site-association의 webcredentials 항목 TEAMID.BUNDLEID로 제공됩니다.",
+      "TEAMID": "팀 ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID는 영숫자 정확히 10자여야 합니다(예: ABCDE12345).",
+      "TEAMIDLENGTH": "Team ID는 영숫자 정확히 10자여야 합니다.",
+      "BUNDLEID": "번들 ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier(CFBundleIdentifier), 예: com.example.app. Team ID 접두사는 포함하지 마세요.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Digital Asset Links / 패스키 자격 증명을 위해 assetlinks.json에서 제공됩니다.",
+      "PACKAGENAME": "패키지 이름",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / 패키지 이름, 예: com.example.app.",
+      "FINGERPRINTS": "SHA-256 인증서 지문",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "줄당 지문 하나(16진수 64자, 콜론 선택 사항). 필요에 따라 디버그 및 릴리스를 포함하세요.",
       "REDIRECT": "리디렉션 URI",
       "REDIRECTSECTION": "리디렉션 URI",
       "POSTLOGOUTREDIRECT": "로그아웃 후 리디렉션 URI",
@@ -2679,7 +2698,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "백채널 로그아웃 URI"
+      "BACKCHANNELLOOGOUTURI": "백채널 로그아웃 URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID와 Bundle ID는 둘 다 설정하거나 둘 다 비워 두어야 합니다.",
+      "ANDROIDPACKAGEREQUIRED": "인증서 지문이 설정된 경우 Android 패키지 이름이 필요합니다."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/mk.json

@@ -2588,6 +2588,25 @@
       "DEVMODEDESC": "Внимавајте: Со овозможен Development mode, URIs за пренасочување нема да бидат валидирани.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Прескокни страница за успешна најава",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Прескокнете ја страницата за успешна најава за оваа нативна апликација.",
+      "APPLINKSSECTION": "Врски за нативни апликации",
+      "APPLINKSDESC": "Конфигурирајте асоцијација за iOS и Android за оваа инстанца да може да доставува trust датотеки за passkeys на вашите нативни апликации.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Се доставува во apple-app-site-association како webcredentials запис TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID мора да има точно 10 алфанумерички знаци, нпр. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID мора да има точно 10 алфанумерички знаци.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), нпр. com.example.app. Не го вклучувајте префиксот Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Се доставува во assetlinks.json за Digital Asset Links / passkey credentials.",
+      "PACKAGENAME": "Име на пакет",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / име на пакет, нпр. com.example.app.",
+      "FINGERPRINTS": "SHA-256 отпечатоци на сертификат",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Еден отпечаток по ред (64 хексадецимални знаци, двоточките се опционални). Вклучете debug и release по потреба.",
       "REDIRECT": "Redirect URIs",
       "REDIRECTSECTION": "Redirect URIs",
       "POSTLOGOUTREDIRECT": "URIs по одјавувањето",
@@ -2651,7 +2670,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID и Bundle ID мора да се постават заедно, или обете да останат празни.",
+      "ANDROIDPACKAGEREQUIRED": "Името на Android пакетот е задолжително кога се поставени отпечатоци од сертификат."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/nl.json

@@ -2610,6 +2610,25 @@
       "DEVMODEDESC": "Let op: Met ingeschakelde ontwikkelingsmodus worden redirect URI's niet gevalideerd.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Sla Login Succes Pagina over",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Sla de succespagina na een login voor deze native app over.",
+      "APPLINKSSECTION": "Native app-koppelingen",
+      "APPLINKSDESC": "Configureer iOS- en Android-associatie zodat deze instance passkey-trustbestanden voor uw native apps kan serveren.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Wordt geserveerd in apple-app-site-association als webcredentials-vermelding TEAMID.BUNDLEID.",
+      "TEAMID": "Team-ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID moet precies 10 alfanumerieke tekens zijn, bijv. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID moet precies 10 alfanumerieke tekens zijn.",
+      "BUNDLEID": "Bundle-ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), bijv. com.example.app. Neem het Team ID-voorvoegsel niet op.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Wordt geserveerd in assetlinks.json voor Digital Asset Links / passkey-credentials.",
+      "PACKAGENAME": "Pakketnaam",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / pakketnaam, bijv. com.example.app.",
+      "FINGERPRINTS": "SHA-256-certificaatvingerafdrukken",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Eén vingerafdruk per regel (64 hexadecimale tekens, dubbele punten optioneel). Voeg desgewenst debug en release toe.",
       "REDIRECT": "Redirect URI's",
       "REDIRECTSECTION": "Redirect URI's",
       "POSTLOGOUTREDIRECT": "Post Logout URI's",
@@ -2673,7 +2692,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID en Bundle ID moeten beide zijn ingesteld, of beide leeg blijven.",
+      "ANDROIDPACKAGEREQUIRED": "Android-pakketnaam is verplicht wanneer certificaatfingerprints zijn ingesteld."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/pl.json

@@ -2591,6 +2591,25 @@
       "DEVMODEDESC": "Uwaga: przy włączonym trybie rozwoju adresy URI przekierowania nie będą sprawdzane.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Pomiń stronę sukcesu po zalogowaniu",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Pomiń stronę sukcesu po zalogowaniu dla tej Natywny aplikację",
+      "APPLINKSSECTION": "Łącza aplikacji natywnych",
+      "APPLINKSDESC": "Skonfiguruj powiązanie iOS i Android, aby ta instancja mogła serwować pliki zaufania passkey dla Twoich aplikacji natywnych.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Serwowane w apple-app-site-association jako wpis webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID musi mieć dokładnie 10 znaków alfanumerycznych, np. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID musi mieć dokładnie 10 znaków alfanumerycznych.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), np. com.example.app. Nie dołączaj prefiksu Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Serwowane w assetlinks.json dla Digital Asset Links / poświadczeń passkey.",
+      "PACKAGENAME": "Nazwa pakietu",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / nazwa pakietu, np. com.example.app.",
+      "FINGERPRINTS": "Odciski certyfikatu SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Jeden odcisk w wierszu (64 znaki szesnastkowe, dwukropki opcjonalne). W razie potrzeby dodaj debug i release.",
       "REDIRECT": "Adresy URI przekierowania",
       "REDIRECTSECTION": "Adresy URI przekierowania",
       "POSTLOGOUTREDIRECT": "Adresy URI po wylogowaniu",
@@ -2654,7 +2673,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "Team ID i Bundle ID iOS muszą być ustawione razem albo oba pozostawione puste.",
+      "ANDROIDPACKAGEREQUIRED": "Nazwa pakietu Android jest wymagana, gdy ustawiono odciski certyfikatu."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/pt.json

@@ -2587,6 +2587,25 @@
       "DEVMODEDESC": "Atenção: Com o modo de desenvolvimento habilitado, as URIs de redirecionamento não serão validadas.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Pular Página de Sucesso de Login",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Pule a página de sucesso após o login para este aplicativo nativo.",
+      "APPLINKSSECTION": "Links de aplicativos nativos",
+      "APPLINKSDESC": "Configure a associação de iOS e Android para que esta instância possa servir arquivos de confiança de passkeys para seus aplicativos nativos.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Servido em apple-app-site-association como entrada webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "O Apple Team ID deve ter exatamente 10 caracteres alfanuméricos, p. ex. ABCDE12345.",
+      "TEAMIDLENGTH": "O Team ID deve ter exatamente 10 caracteres alfanuméricos.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "Identificador de pacote iOS (CFBundleIdentifier), p. ex. com.example.app. Não inclua o prefixo do Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Servido em assetlinks.json para Digital Asset Links / credenciais de passkey.",
+      "PACKAGENAME": "Nome do pacote",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "applicationId / nome do pacote Android, p. ex. com.example.app.",
+      "FINGERPRINTS": "Impressões digitais do certificado SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Uma impressão por linha (64 caracteres hexadecimais, dois-pontos opcionais). Inclua debug e release conforme necessário.",
       "REDIRECT": "URIs de Redirecionamento",
       "REDIRECTSECTION": "URIs de Redirecionamento",
       "POSTLOGOUTREDIRECT": "URIs de Pós-Logout",
@@ -2650,7 +2669,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "O Team ID e o Bundle ID do iOS devem estar ambos definidos, ou ambos vazios.",
+      "ANDROIDPACKAGEREQUIRED": "O nome do pacote Android é obrigatório quando as impressões digitais do certificado estão definidas."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/ro.json

@@ -2612,6 +2612,25 @@
       "DEVMODEDESC": "Atenție: Cu modul de dezvoltare activat, URI-urile de redirecționare nu vor fi validate.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Omiteți pagina de succes la conectare",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Omiteți pagina de succes după o conectare pentru această aplicație nativă.",
+      "APPLINKSSECTION": "Linkuri pentru aplicații native",
+      "APPLINKSDESC": "Configurați asocierea iOS și Android pentru ca această instanță să poată servi fișierele de încredere passkey pentru aplicațiile dvs. native.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Servit în apple-app-site-association ca intrare webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID trebuie să aibă exact 10 caractere alfanumerice, de ex. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID trebuie să aibă exact 10 caractere alfanumerice.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "Identificatorul de bundle iOS (CFBundleIdentifier), de ex. com.example.app. Nu includeți prefixul Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Servit în assetlinks.json pentru Digital Asset Links / acreditări passkey.",
+      "PACKAGENAME": "Numele pachetului",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / numele pachetului, de ex. com.example.app.",
+      "FINGERPRINTS": "Amprente de certificat SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "O amprentă pe linie (64 caractere hexazecimale, două puncte opționale). Includeți debug și release după nevoie.",
       "REDIRECT": "URI-uri de redirecționare",
       "REDIRECTSECTION": "URI-uri de redirecționare",
       "POSTLOGOUTREDIRECT": "URI-uri de redirecționare după deconectare",
@@ -2675,7 +2694,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "Team ID și Bundle ID iOS trebuie setate împreună sau ambele lăsate goale.",
+      "ANDROIDPACKAGEREQUIRED": "Numele pachetului Android este obligatoriu când sunt setate amprentele certificatului."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/ru.json

@@ -2704,6 +2704,25 @@
       "DEVMODEDESC": "Осторожно: При включённом режиме разработки URI перенаправления не будут проверяться.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Пропустить страницу успешного входа в систему",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Пропустите страницу успеха после входа в систему для этого собственного приложения.",
+      "APPLINKSSECTION": "Ссылки нативных приложений",
+      "APPLINKSDESC": "Настройте ассоциацию iOS и Android, чтобы этот инстанс мог отдавать trust-файлы passkey для ваших нативных приложений.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Отдаётся в apple-app-site-association как запись webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID должен состоять ровно из 10 буквенно-цифровых символов, напр. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID должен состоять ровно из 10 буквенно-цифровых символов.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), напр. com.example.app. Не включайте префикс Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Отдаётся в assetlinks.json для Digital Asset Links / учётных данных passkey.",
+      "PACKAGENAME": "Имя пакета",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / имя пакета, напр. com.example.app.",
+      "FINGERPRINTS": "Отпечатки сертификата SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Один отпечаток в строке (64 шестнадцатеричных символа, двоеточия необязательны). При необходимости укажите debug и release.",
       "REDIRECT": "Перенаправление URI",
       "REDIRECTSECTION": "Перенаправление URI",
       "POSTLOGOUTREDIRECT": "URI после выхода из системы",
@@ -2767,7 +2786,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "URI выхода из системы через резервный канал"
+      "BACKCHANNELLOOGOUTURI": "URI выхода из системы через резервный канал",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID и Bundle ID должны быть заданы вместе или оба оставлены пустыми.",
+      "ANDROIDPACKAGEREQUIRED": "Имя пакета Android обязательно, если заданы отпечатки сертификата."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/sv.json

@@ -2619,6 +2619,25 @@
       "DEVMODEDESC": "Observera: Med utvecklingsläge aktiverat kommer omdirigerings-URI:er inte att valideras.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Hoppa över inloggningsframgångssida",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Hoppa över framgångssidan efter en inloggning för denna inhemska app.",
+      "APPLINKSSECTION": "Länkar för inbyggda appar",
+      "APPLINKSDESC": "Konfigurera iOS- och Android-association så att den här instansen kan servera passkey-trustfiler för dina inbyggda appar.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Serveras i apple-app-site-association som webcredentials-posten TEAMID.BUNDLEID.",
+      "TEAMID": "Team-ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID måste vara exakt 10 alfanumeriska tecken, t.ex. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID måste vara exakt 10 alfanumeriska tecken.",
+      "BUNDLEID": "Bundle-ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), t.ex. com.example.app. Inkludera inte Team ID-prefixet.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Serveras i assetlinks.json för Digital Asset Links / passkey-uppgifter.",
+      "PACKAGENAME": "Paketnamn",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / paketnamn, t.ex. com.example.app.",
+      "FINGERPRINTS": "SHA-256-certifikatfingeravtryck",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Ett fingeravtryck per rad (64 hexadecimala tecken, kolon valfritt). Inkludera debug och release vid behov.",
       "REDIRECT": "Omdirigerings-URI:er",
       "REDIRECTSECTION": "Omdirigerings-URI:er",
       "POSTLOGOUTREDIRECT": "Post Logout-URI:er",
@@ -2682,7 +2701,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID och Bundle ID måste båda anges, eller båda lämnas tomma.",
+      "ANDROIDPACKAGEREQUIRED": "Android-paketnamn krävs när certifikatfingeravtryck anges."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/tr.json

@@ -2620,6 +2620,25 @@
       "DEVMODEDESC": "Dikkat: Geliştirme modu etkinleştirildiğinde yönlendirme URI'leri doğrulanmayacaktır.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Giriş Başarı Sayfasını Atla",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Bu yerel uygulama için giriş sonrası başarı sayfasını atla.",
+      "APPLINKSSECTION": "Yerel uygulama bağlantıları",
+      "APPLINKSDESC": "Bu instansın yerel uygulamalarınız için passkey güven dosyalarını sunabilmesi amacıyla iOS ve Android ilişkilendirmesini yapılandırın.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "apple-app-site-association içinde webcredentials girdisi TEAMID.BUNDLEID olarak sunulur.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID tam olarak 10 alfanümerik karakter olmalıdır, örn. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID tam olarak 10 alfanümerik karakter olmalıdır.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), örn. com.example.app. Team ID önekini eklemeyin.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Digital Asset Links / passkey kimlik bilgileri için assetlinks.json içinde sunulur.",
+      "PACKAGENAME": "Paket adı",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / paket adı, örn. com.example.app.",
+      "FINGERPRINTS": "SHA-256 sertifika parmak izleri",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Satır başına bir parmak izi (64 onaltılık karakter, iki nokta isteğe bağlı). Gerektiğinde debug ve release ekleyin.",
       "REDIRECT": "Yönlendirme URI'leri",
       "REDIRECTSECTION": "Yönlendirme URI'leri",
       "POSTLOGOUTREDIRECT": "Çıkış Sonrası URI'ler",
@@ -2683,7 +2702,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI"
+      "BACKCHANNELLOOGOUTURI": "Back-Channel Logout URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID ve Bundle ID ikisi birden ayarlanmalı veya ikisi de boş bırakılmalıdır.",
+      "ANDROIDPACKAGEREQUIRED": "Sertifika parmak izleri ayarlandığında Android paket adı zorunludur."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/uk.json

@@ -2622,6 +2622,25 @@
       "DEVMODEDESC": "Увага: з увімкненим режимом розробки URI перенаправлення не перевірятимуться.",
       "SKIPNATIVEAPPSUCCESSPAGE": "Пропустити сторінку успішного входу",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Пропустити сторінку успіху після входу для цього нативного додатку.",
+      "APPLINKSSECTION": "Посилання нативних застосунків",
+      "APPLINKSDESC": "Налаштуйте асоціацію iOS та Android, щоб цей інстанс міг віддавати trust-файли passkey для ваших нативних застосунків.",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "Віддається в apple-app-site-association як запис webcredentials TEAMID.BUNDLEID.",
+      "TEAMID": "Team ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID має складатися рівно з 10 буквено-цифрових символів, напр. ABCDE12345.",
+      "TEAMIDLENGTH": "Team ID має складатися рівно з 10 буквено-цифрових символів.",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier (CFBundleIdentifier), напр. com.example.app. Не включайте префікс Team ID.",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "Віддається в assetlinks.json для Digital Asset Links / облікових даних passkey.",
+      "PACKAGENAME": "Назва пакета",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / назва пакета, напр. com.example.app.",
+      "FINGERPRINTS": "Відбитки сертифіката SHA-256",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "Один відбиток у рядку (64 шістнадцяткові символи, двокрапки необов’язкові). За потреби вкажіть debug і release.",
       "REDIRECT": "URI перенаправлення",
       "REDIRECTSECTION": "URI перенаправлення",
       "POSTLOGOUTREDIRECT": "URI після виходу",
@@ -2685,7 +2704,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "URI виходу з зворотного каналу"
+      "BACKCHANNELLOOGOUTURI": "URI виходу з зворотного каналу",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID та Bundle ID мають бути задані разом або обидва залишені порожніми.",
+      "ANDROIDPACKAGEREQUIRED": "Назва пакета Android обов’язкова, якщо задано відбитки сертифіката."
     },
     "API": {
       "INFO": {

console/src/assets/i18n/zh.json

@@ -2624,6 +2624,25 @@
       "DEVMODEDESC": "注意：启用开发模式的重定向 URI 将不会被验证。",
       "SKIPNATIVEAPPSUCCESSPAGE": "登录后跳过成功页面",
       "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "登录后跳过本机应用的成功页面",
+      "APPLINKSSECTION": "原生应用关联",
+      "APPLINKSDESC": "配置 iOS 和 Android 关联，使此实例能够为您的原生应用提供通行密钥信任文件。",
+      "IOSTITLE": "iOS",
+      "IOSDESC": "在 apple-app-site-association 中作为 webcredentials 条目 TEAMID.BUNDLEID 提供。",
+      "TEAMID": "团队 ID",
+      "TEAMIDPLACEHOLDER": "ABCDE12345",
+      "TEAMIDDESC": "Apple Team ID 必须恰好为 10 个字母或数字，例如 ABCDE12345。",
+      "TEAMIDLENGTH": "Team ID 必须恰好为 10 个字母或数字。",
+      "BUNDLEID": "Bundle ID",
+      "BUNDLEIDPLACEHOLDER": "com.example.app",
+      "BUNDLEIDDESC": "iOS Bundle Identifier（CFBundleIdentifier），例如 com.example.app。请勿包含 Team ID 前缀。",
+      "ANDROIDTITLE": "Android",
+      "ANDROIDDESC": "在 assetlinks.json 中为 Digital Asset Links / 通行密钥凭据提供。",
+      "PACKAGENAME": "软件包名称",
+      "PACKAGENAMEPLACEHOLDER": "com.example.app",
+      "PACKAGENAMEDESC": "Android applicationId / 软件包名称，例如 com.example.app。",
+      "FINGERPRINTS": "SHA-256 证书指纹",
+      "FINGERPRINTSPLACEHOLDER": "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
+      "FINGERPRINTSDESC": "每行一个指纹（64 个十六进制字符，冒号可选）。按需包含调试版和正式版。",
       "REDIRECT": "重定向 URLs",
       "REDIRECTSECTION": "重定向 URLs",
       "POSTLOGOUTREDIRECT": "退出登录重定向 URLs",
@@ -2687,7 +2706,9 @@
           }
         }
       },
-      "BACKCHANNELLOOGOUTURI": "反向通道注销URI"
+      "BACKCHANNELLOOGOUTURI": "反向通道注销URI",
+      "IOSAPPLINKINCOMPLETE": "iOS Team ID 与 Bundle ID 必须同时填写，或同时留空。",
+      "ANDROIDPACKAGEREQUIRED": "设置证书指纹时必须填写 Android 软件包名称。"
     },
     "API": {
       "INFO": {