Checkout SDK Updates — iOS v1.6.1, React Native v1.2.1

iOS — v1.6.1 (2026-08-12)

Payment method details on PaymentResult: after a successful card, bank-account, or offsite tokenize — and after a successful CVV recache — merchants can read the API payment_method via result.paymentResponse?.transaction?.paymentMethod (Swift), including lastFourDigits, firstSixDigits, card/ACH/offsite fields, and typed binMetadata. Objective-C exposes the same nested camelCase shape via paymentResponseDictionary on PaymentResult.

Click to Pay host-page injection hardening: srcDpaId and locale are validated before host load and safely encoded when substituted into the Click to Pay WebView host page; Mastercard lib.js query parameters are percent-encoded.
Click to Pay WebView hardening: release builds no longer mark Click to Pay WebViews as inspectable; native bridge handlers accept main-frame messages only; inbound bridge payloads reject additional cardholder-data key aliases; sandbox Mastercard hosts are allowed only when isSandbox is true.
Mandate nesting resource guard: mandates that nest beyond the client resource depth are rejected at request construction instead of risking a host-app crash during tokenization.

Mandate at tokenization: optional mandate on SpreedlyCore.createCreditCard() and SpreedlyCore.createBankAccount(), forwarded verbatim to Spreedly at payment_method.mandate. Opaque to the SDK — Spreedly owns the schema and validates server-side, versioned by source_version, so mandate changes never require an SDK upgrade. Wire semantics follow ECMA-262 JSON.stringify: NaN/Infinity encode as null, and the field is omitted only when absent or empty. A mandate value with no JSON representation fails the call with an error naming the key — the SDK never silently drops or alters a mandate. Exports a Mandate type for typing your own values. Never put cardholder data in a mandate.
Full payment method response passthrough: completed results from createCreditCard, createBankAccount, payment/ACH bottom sheets, and recache now include the native Spreedly paymentMethodResponse (transaction + payment_method fields), plus shouldRetain, state, and paymentMethodUpdatedAt when present. mapPaymentResult() is unchanged for UI outcomes; read the full payload from the raw promise/event result.

Native SDK pins for RN 1.2.1: checkout-android 1.3.0, checkout-ios-package 1.6.1.