From f5ed9fe3298029d058f5cd43a611c097a9301d16 Mon Sep 17 00:00:00 2001
From: Carlos Munoz <carlosmuvi@stripe.com>
Date: Sun, 22 Dec 2024 20:35:50 +0100
Subject: [PATCH] Updates lookup call to use mobile endpoint on verified flows

---
 .idea/codestyles/Project.xml                  |  4 +-
 ...FinancialConnectionsPlaygroundViewModel.kt |  4 +-
 financial-connections/detekt-baseline.xml     |  1 +
 ...nancialConnectionsSheetRedirectActivity.kt | 20 +++++++-
 .../FinancialConnectionsSheetViewModel.kt     | 34 +++++++++++++
 ...nnectionsSingletonSharedComponentHolder.kt |  9 +++-
 .../domain/HandleError.kt                     | 15 ++++--
 .../domain/IntegrityVerdictManager.kt         | 20 ++++++++
 .../domain/LookupAccount.kt                   | 34 ++++++++++---
 .../LookupConsumerAndStartVerification.kt     | 11 ++++-
 .../features/error/ErrorExt.kt                | 12 +++++
 .../networkinglinksignup/LinkSignupHandler.kt |  6 +--
 ...rkingLinkSignupPreviewParameterProvider.kt |  8 +++
 .../NetworkingLinkSignupViewModel.kt          | 20 ++++++--
 .../NetworkingLinkVerificationViewModel.kt    |  6 ++-
 .../FinancialConnectionsSessionManifest.kt    |  3 ++
 ...inancialConnectionsSheetNativeViewModel.kt |  9 +++-
 ...ialConnectionsConsumerSessionRepository.kt | 49 +++++++++++++------
 .../financialconnections/ApiKeyFixtures.kt    |  1 +
 .../LookupConsumerAndStartVerificationTest.kt | 29 +++++++++--
 .../NetworkingLinkSignupViewModelTest.kt      | 24 ++++-----
 ...NetworkingLinkVerificationViewModelTest.kt | 22 ++++++++-
 ...ctionsConsumerSessionRepositoryImplTest.kt |  2 +-
 .../utils/TestHandleError.kt                  |  2 +-
 .../com/stripe/android/model/EmailSource.kt   | 12 +++++
 .../android/repository/ConsumersApiService.kt | 46 +++++++++++++++++
 26 files changed, 338 insertions(+), 65 deletions(-)
 create mode 100644 financial-connections/src/main/java/com/stripe/android/financialconnections/domain/IntegrityVerdictManager.kt
 create mode 100644 financial-connections/src/main/java/com/stripe/android/financialconnections/features/error/ErrorExt.kt
 create mode 100644 payments-model/src/main/java/com/stripe/android/model/EmailSource.kt

diff --git a/.idea/codestyles/Project.xml b/.idea/codestyles/Project.xml
index aa7276802a9..90ee029868b 100644
--- a/.idea/codestyles/Project.xml
+++ b/.idea/codestyles/Project.xml
@@ -32,8 +32,6 @@
           <package name="kotlinx.android.synthetic" alias="false" withSubpackages="true" />
         </value>
       </option>
-      <option name="NAME_COUNT_TO_USE_STAR_IMPORT" value="2147483647" />
-      <option name="NAME_COUNT_TO_USE_STAR_IMPORT_FOR_MEMBERS" value="2147483647" />
       <option name="LINE_BREAK_AFTER_MULTILINE_WHEN_ENTRY" value="false" />
       <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
     </JetCodeStyleSettings>
@@ -160,4 +158,4 @@
       </indentOptions>
     </codeStyleSettings>
   </code_scheme>
-</component>
+</component>
\ No newline at end of file
diff --git a/financial-connections-example/src/main/java/com/stripe/android/financialconnections/example/FinancialConnectionsPlaygroundViewModel.kt b/financial-connections-example/src/main/java/com/stripe/android/financialconnections/example/FinancialConnectionsPlaygroundViewModel.kt
index a63255e0bfb..77dda6e7678 100644
--- a/financial-connections-example/src/main/java/com/stripe/android/financialconnections/example/FinancialConnectionsPlaygroundViewModel.kt
+++ b/financial-connections-example/src/main/java/com/stripe/android/financialconnections/example/FinancialConnectionsPlaygroundViewModel.kt
@@ -442,9 +442,7 @@ enum class Merchant(
     Networking("networking"),
     LiveTesting("live_testing", canSwitchBetweenTestAndLive = false),
     TestMode("testmode", canSwitchBetweenTestAndLive = false),
-    NmeDefaultVerification("nme", canSwitchBetweenTestAndLive = true),
-    NmeABAVVerification("nme_abav", canSwitchBetweenTestAndLive = true),
-    NmeSkipVerification("nme_skip", canSwitchBetweenTestAndLive = true),
+    Trusted("trusted", canSwitchBetweenTestAndLive = false),
     Custom("other");
 
     companion object {
diff --git a/financial-connections/detekt-baseline.xml b/financial-connections/detekt-baseline.xml
index 9a70a986a90..2ec88779b7f 100644
--- a/financial-connections/detekt-baseline.xml
+++ b/financial-connections/detekt-baseline.xml
@@ -8,6 +8,7 @@
     <ID>LongMethod:AccountItem.kt$@Composable @Preview internal fun AccountItemPreview()</ID>
     <ID>LongMethod:Button.kt$@Composable internal fun FinancialConnectionsButton( onClick: () -> Unit, modifier: Modifier = Modifier, type: Type = Primary, size: FinancialConnectionsButton.Size = FinancialConnectionsButton.Size.Regular, enabled: Boolean = true, loading: Boolean = false, content: @Composable (RowScope.() -> Unit) )</ID>
     <ID>LongMethod:FinancialConnectionsSheetNativeActivity.kt$FinancialConnectionsSheetNativeActivity$@Composable fun NavHost( initialPane: Pane, testMode: Boolean, )</ID>
+    <ID>LongMethod:FinancialConnectionsSheetNativeViewModel.kt$FinancialConnectionsSheetNativeViewModel$private fun closeAuthFlow( earlyTerminationCause: EarlyTerminationCause? = null, closeAuthFlowError: Throwable? = null )</ID>
     <ID>LongMethod:InstitutionPickerScreen.kt$private fun LazyListScope.searchResults( isInputEmpty: Boolean, payload: Payload, selectedInstitutionId: String?, onInstitutionSelected: (FinancialConnectionsInstitution, Boolean) -> Unit, institutions: Async&lt;InstitutionResponse>, onManualEntryClick: () -> Unit, onSearchMoreClick: () -> Unit )</ID>
     <ID>LongMethod:LinkAccountPickerPreviewParameterProvider.kt$LinkAccountPickerPreviewParameterProvider$private fun partnerAccountList()</ID>
     <ID>LongMethod:NetworkingSaveToLinkVerificationScreen.kt$@Composable private fun NetworkingSaveToLinkVerificationLoaded( confirmVerificationAsync: Async&lt;Unit>, payload: Payload, onCloseFromErrorClick: (Throwable) -> Unit, onSkipClick: () -> Unit, )</ID>
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetRedirectActivity.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetRedirectActivity.kt
index bbc0e3a6085..8d41e4e57f9 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetRedirectActivity.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetRedirectActivity.kt
@@ -5,6 +5,7 @@ import android.net.Uri
 import android.os.Bundle
 import androidx.appcompat.app.AppCompatActivity
 import com.stripe.android.financialconnections.debug.DebugConfiguration
+import com.stripe.android.financialconnections.di.FinancialConnectionsSingletonSharedComponentHolder
 import com.stripe.android.financialconnections.ui.FinancialConnectionsSheetNativeActivity
 
 /**
@@ -20,7 +21,9 @@ class FinancialConnectionsSheetRedirectActivity : AppCompatActivity() {
          */
         intent.data
             ?.let { uri ->
-                val uriWithDebugConfiguration = uri.overrideWithDebugConfiguration()
+                val uriWithDebugConfiguration = uri
+                    .overrideWithDebugConfiguration()
+                    .overrideIfIntegrityFailed()
                 uriWithDebugConfiguration.toIntent()
                     ?.setFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP)
                     ?.also { it.data = uriWithDebugConfiguration }
@@ -67,6 +70,21 @@ class FinancialConnectionsSheetRedirectActivity : AppCompatActivity() {
             null -> this
         }
 
+    /**
+     * When an integrity verdict fails, clients will switch to the web flow locally but backend will still
+     * consider the flow native. This checks the local verdict state and overrides native deep links to web.
+     */
+    private fun Uri.overrideIfIntegrityFailed(): Uri =
+        when (
+            FinancialConnectionsSingletonSharedComponentHolder
+                .getComponent(application)
+                .integrityVerdictManager()
+                .verdictFailed()
+        ) {
+            true -> Uri.parse(toString().replace(HOST_NATIVE_LINK_ACCOUNTS, HOST_LINK_ACCOUNTS))
+            else -> this
+        }
+
     private fun Uri.isFinancialConnectionsScheme(): Boolean {
         return (this.scheme == "stripe-auth" || this.scheme == "stripe")
     }
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetViewModel.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetViewModel.kt
index d7414e620ca..60b58d0eb46 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetViewModel.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/FinancialConnectionsSheetViewModel.kt
@@ -36,10 +36,12 @@ import com.stripe.android.financialconnections.domain.FetchFinancialConnectionsS
 import com.stripe.android.financialconnections.domain.FetchFinancialConnectionsSessionForToken
 import com.stripe.android.financialconnections.domain.GetOrFetchSync
 import com.stripe.android.financialconnections.domain.GetOrFetchSync.RefetchCondition.Always
+import com.stripe.android.financialconnections.domain.IntegrityVerdictManager
 import com.stripe.android.financialconnections.domain.NativeAuthFlowCoordinator
 import com.stripe.android.financialconnections.domain.NativeAuthFlowRouter
 import com.stripe.android.financialconnections.exception.AppInitializationError
 import com.stripe.android.financialconnections.exception.CustomManualEntryRequiredError
+import com.stripe.android.financialconnections.features.error.isAttestationError
 import com.stripe.android.financialconnections.features.manualentry.isCustomManualEntryError
 import com.stripe.android.financialconnections.launcher.FinancialConnectionsSheetActivityArgs
 import com.stripe.android.financialconnections.launcher.FinancialConnectionsSheetActivityArgs.ForData
@@ -71,6 +73,7 @@ internal class FinancialConnectionsSheetViewModel @Inject constructor(
     savedStateHandle: SavedStateHandle,
     private val getOrFetchSync: GetOrFetchSync,
     private val integrityRequestManager: IntegrityRequestManager,
+    private val integrityVerdictManager: IntegrityVerdictManager,
     private val fetchFinancialConnectionsSession: FetchFinancialConnectionsSession,
     private val fetchFinancialConnectionsSessionForToken: FetchFinancialConnectionsSessionForToken,
     private val logger: Logger,
@@ -128,6 +131,11 @@ internal class FinancialConnectionsSheetViewModel @Inject constructor(
     }
 
     private suspend fun prepareStandardRequestManager(): Boolean {
+        // If previously within the application session an integrity check failed
+        // do not initialize the request manager and directly launch the web flow.
+        if (integrityVerdictManager.verdictFailed()) {
+            return false
+        }
         val result = integrityRequestManager.prepare()
         result.exceptionOrNull()?.let {
             analyticsTracker.track(
@@ -521,6 +529,10 @@ internal class FinancialConnectionsSheetViewModel @Inject constructor(
         fromNative: Boolean = false,
         @StringRes finishMessage: Int? = null,
     ) {
+        if (result is Failed && result.error.isAttestationError()) {
+            switchToWebFlow()
+            return
+        }
         eventReporter.onResult(state.initialArgs.configuration, result)
         // Native emits its own events before finishing.
         if (fromNative.not()) {
@@ -536,6 +548,28 @@ internal class FinancialConnectionsSheetViewModel @Inject constructor(
         setState { copy(viewEffect = FinishWithResult(result, finishMessage)) }
     }
 
+    /**
+     * On scenarios where native failed mid flow due to attestation errors, switch back to web flow.
+     */
+    private fun switchToWebFlow() {
+        integrityVerdictManager.setVerdictFailed()
+        viewModelScope.launch {
+            val sync = getOrFetchSync()
+            val hostedAuthUrl = HostedAuthUrlBuilder.create(
+                args = initialState.initialArgs,
+                manifest = sync.manifest,
+            )!!
+            setState {
+                copy(
+                    manifest = manifest,
+                    // Use intermediate state to prevent the flow from closing in [onResume].
+                    webAuthFlowStatus = AuthFlowStatus.INTERMEDIATE_DEEPLINK,
+                    viewEffect = OpenAuthFlowWithUrl(hostedAuthUrl)
+                )
+            }
+        }
+    }
+
     companion object {
 
         val Factory = viewModelFactory {
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/di/FinancialConnectionsSingletonSharedComponentHolder.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/di/FinancialConnectionsSingletonSharedComponentHolder.kt
index 0a151dd3d75..decf4b726dc 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/di/FinancialConnectionsSingletonSharedComponentHolder.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/di/FinancialConnectionsSingletonSharedComponentHolder.kt
@@ -2,6 +2,7 @@ package com.stripe.android.financialconnections.di
 
 import android.app.Application
 import com.stripe.android.core.Logger
+import com.stripe.android.financialconnections.domain.IntegrityVerdictManager
 import com.stripe.attestation.BuildConfig
 import com.stripe.attestation.IntegrityRequestManager
 import com.stripe.attestation.IntegrityStandardRequestManager
@@ -38,7 +39,9 @@ internal object FinancialConnectionsSingletonSharedComponentHolder {
 @Component(modules = [FinancialConnectionsSingletonSharedModule::class])
 internal interface FinancialConnectionsSingletonSharedComponent {
 
-    fun providesIntegrityRequestManager(): IntegrityRequestManager
+    fun integrityRequestManager(): IntegrityRequestManager
+
+    fun integrityVerdictManager(): IntegrityVerdictManager
 
     @Component.Builder
     interface Builder {
@@ -61,4 +64,8 @@ internal class FinancialConnectionsSingletonSharedModule {
         logError = { message, error -> Logger.getInstance(BuildConfig.DEBUG).error(message, error) },
         factory = RealStandardIntegrityManagerFactory(context)
     )
+
+    @Provides
+    @Singleton
+    fun providesIntegrityVerdictManager(): IntegrityVerdictManager = IntegrityVerdictManager()
 }
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/HandleError.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/HandleError.kt
index ffc56b6c0fd..83e8f6c4757 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/HandleError.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/HandleError.kt
@@ -3,6 +3,8 @@ package com.stripe.android.financialconnections.domain
 import com.stripe.android.core.Logger
 import com.stripe.android.financialconnections.analytics.FinancialConnectionsAnalyticsTracker
 import com.stripe.android.financialconnections.analytics.logError
+import com.stripe.android.financialconnections.domain.NativeAuthFlowCoordinator.Message.CloseWithError
+import com.stripe.android.financialconnections.features.error.isAttestationError
 import com.stripe.android.financialconnections.model.FinancialConnectionsSessionManifest
 import com.stripe.android.financialconnections.navigation.Destination
 import com.stripe.android.financialconnections.navigation.NavigationManager
@@ -10,7 +12,7 @@ import com.stripe.android.financialconnections.repository.FinancialConnectionsEr
 import javax.inject.Inject
 
 internal interface HandleError {
-    operator fun invoke(
+    suspend operator fun invoke(
         extraMessage: String,
         error: Throwable,
         pane: FinancialConnectionsSessionManifest.Pane,
@@ -21,6 +23,7 @@ internal interface HandleError {
 internal class RealHandleError @Inject constructor(
     private val errorRepository: FinancialConnectionsErrorRepository,
     private val analyticsTracker: FinancialConnectionsAnalyticsTracker,
+    private val nativeAuthFlowCoordinator: NativeAuthFlowCoordinator,
     private val logger: Logger,
     private val navigationManager: NavigationManager
 ) : HandleError {
@@ -38,11 +41,11 @@ internal class RealHandleError @Inject constructor(
      * @param displayErrorScreen whether to navigate to the error screen
      *
      */
-    override operator fun invoke(
+    override suspend operator fun invoke(
         extraMessage: String,
         error: Throwable,
         pane: FinancialConnectionsSessionManifest.Pane,
-        displayErrorScreen: Boolean
+        displayErrorScreen: Boolean,
     ) {
         analyticsTracker.logError(
             extraMessage = extraMessage,
@@ -51,8 +54,10 @@ internal class RealHandleError @Inject constructor(
             pane = pane
         )
 
-        // Navigate to error screen
-        if (displayErrorScreen) {
+        if (error.isAttestationError()) {
+            nativeAuthFlowCoordinator().emit(CloseWithError(cause = error))
+        } else if (displayErrorScreen) {
+            // Navigate to error screen
             errorRepository.set(error)
             navigationManager.tryNavigateTo(route = Destination.Error(referrer = pane))
         }
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/IntegrityVerdictManager.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/IntegrityVerdictManager.kt
new file mode 100644
index 00000000000..196d328cb97
--- /dev/null
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/IntegrityVerdictManager.kt
@@ -0,0 +1,20 @@
+package com.stripe.android.financialconnections.domain
+
+/**
+ * Manages the verdict of the integrity check. If the verdict is failed, the user will be switched to web flow.
+ *
+ * The scope of this is the application session. Subsequent launches of the AuthFlow within the hosting app after
+ * a verdict failure will directly launch the web flow.
+ */
+internal class IntegrityVerdictManager {
+
+    private var verdictFailed: Boolean = false
+
+    fun setVerdictFailed() {
+        verdictFailed = true
+    }
+
+    fun verdictFailed(): Boolean {
+        return verdictFailed
+    }
+}
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupAccount.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupAccount.kt
index 1b14c57fa9e..aac5f864883 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupAccount.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupAccount.kt
@@ -1,21 +1,41 @@
 package com.stripe.android.financialconnections.domain
 
+import android.app.Application
 import com.stripe.android.financialconnections.FinancialConnectionsSheet
 import com.stripe.android.financialconnections.repository.FinancialConnectionsConsumerSessionRepository
 import com.stripe.android.model.ConsumerSessionLookup
+import com.stripe.android.model.EmailSource
+import com.stripe.attestation.IntegrityRequestManager
 import javax.inject.Inject
 
 internal class LookupAccount @Inject constructor(
+    private val application: Application,
+    private val integrityRequestManager: IntegrityRequestManager,
     private val consumerSessionRepository: FinancialConnectionsConsumerSessionRepository,
     val configuration: FinancialConnectionsSheet.Configuration,
 ) {
 
     suspend operator fun invoke(
-        email: String
-    ): ConsumerSessionLookup = requireNotNull(
-        consumerSessionRepository.lookupConsumerSession(
-            email = email.lowercase().trim(),
-            clientSecret = configuration.financialConnectionsSessionClientSecret
-        )
-    )
+        email: String,
+        emailSource: EmailSource,
+        verifiedFlow: Boolean
+    ): ConsumerSessionLookup {
+        return if (verifiedFlow) {
+            requireNotNull(
+                consumerSessionRepository.mobileLookupConsumerSession(
+                    email = email.lowercase().trim(),
+                    emailSource = emailSource,
+                    verificationToken = integrityRequestManager.requestToken().getOrThrow(),
+                    appId = application.packageName
+                )
+            )
+        } else {
+            requireNotNull(
+                consumerSessionRepository.postConsumerSession(
+                    email = email.lowercase().trim(),
+                    clientSecret = configuration.financialConnectionsSessionClientSecret
+                )
+            )
+        }
+    }
 }
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerification.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerification.kt
index 4816b09d398..76781f21126 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerification.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerification.kt
@@ -1,6 +1,7 @@
 package com.stripe.android.financialconnections.domain
 
 import com.stripe.android.model.ConsumerSession
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.VerificationType
 import javax.inject.Inject
 
@@ -20,15 +21,23 @@ internal class LookupConsumerAndStartVerification @Inject constructor(
      */
     suspend operator fun invoke(
         email: String,
+        emailSource: EmailSource,
         businessName: String?,
         verificationType: VerificationType,
+        appVerificationEnabled: Boolean,
         onConsumerNotFound: suspend () -> Unit,
         onLookupError: suspend (Throwable) -> Unit,
         onStartVerification: suspend () -> Unit,
         onVerificationStarted: suspend (ConsumerSession) -> Unit,
         onStartVerificationError: suspend (Throwable) -> Unit
     ) {
-        runCatching { lookupAccount(email) }
+        runCatching {
+            lookupAccount(
+                email = email,
+                emailSource = emailSource,
+                verifiedFlow = appVerificationEnabled
+            )
+        }
             .onSuccess { session ->
                 if (session.exists) {
                     onStartVerification()
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/error/ErrorExt.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/error/ErrorExt.kt
new file mode 100644
index 00000000000..1c250f152c8
--- /dev/null
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/error/ErrorExt.kt
@@ -0,0 +1,12 @@
+package com.stripe.android.financialconnections.features.error
+
+import com.stripe.android.core.exception.APIException
+import com.stripe.attestation.AttestationError
+
+internal fun Throwable.isAttestationError(): Boolean = when (this) {
+    // Stripe backend could not verify the intregrity of the request
+    is APIException -> stripeError?.code == "link_failed_to_attest_request"
+    // Interaction with Integrity API to generate tokens resulted in a failure
+    is AttestationError -> true
+    else -> false
+}
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/LinkSignupHandler.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/LinkSignupHandler.kt
index 1adbac0b4a8..f935fe760a0 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/LinkSignupHandler.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/LinkSignupHandler.kt
@@ -27,7 +27,7 @@ internal interface LinkSignupHandler {
         state: NetworkingLinkSignupState,
     ): Pane
 
-    fun handleSignupFailure(
+    suspend fun handleSignupFailure(
         error: Throwable,
     )
 
@@ -65,7 +65,7 @@ internal class LinkSignupHandlerForInstantDebits @Inject constructor(
         navigationManager.tryNavigateTo(NetworkingLinkVerification(referrer = LINK_LOGIN))
     }
 
-    override fun handleSignupFailure(error: Throwable) {
+    override suspend fun handleSignupFailure(error: Throwable) {
         handleError(
             extraMessage = "Error creating a Link account",
             error = error,
@@ -107,7 +107,7 @@ internal class LinkSignupHandlerForNetworking @Inject constructor(
         navigationManager.tryNavigateTo(NetworkingSaveToLinkVerification(referrer = NETWORKING_LINK_SIGNUP_PANE))
     }
 
-    override fun handleSignupFailure(error: Throwable) {
+    override suspend fun handleSignupFailure(error: Throwable) {
         eventTracker.logError(
             extraMessage = "Error saving account to Link",
             error = error,
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupPreviewParameterProvider.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupPreviewParameterProvider.kt
index b15b00e9fa6..e1c42cef1fc 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupPreviewParameterProvider.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupPreviewParameterProvider.kt
@@ -24,12 +24,14 @@ internal class NetworkingLinkSignupPreviewParameterProvider :
         payload = Success(
             NetworkingLinkSignupState.Payload(
                 merchantName = "Test",
+                prefilledEmail = null,
                 emailController = EmailConfig.createController(""),
                 phoneController = PhoneNumberController.createPhoneNumberController(
                     initialValue = "",
                     initiallySelectedCountryCode = null,
                 ),
                 isInstantDebits = false,
+                appVerificationEnabled = false,
                 content = networkingLinkSignupPane(),
             )
         ),
@@ -43,12 +45,14 @@ internal class NetworkingLinkSignupPreviewParameterProvider :
         payload = Success(
             NetworkingLinkSignupState.Payload(
                 merchantName = "Test",
+                prefilledEmail = null,
                 emailController = EmailConfig.createController("valid@email.com"),
                 phoneController = PhoneNumberController.createPhoneNumberController(
                     initialValue = "",
                     initiallySelectedCountryCode = null,
                 ),
                 isInstantDebits = false,
+                appVerificationEnabled = false,
                 content = networkingLinkSignupPane(),
             )
         ),
@@ -68,12 +72,14 @@ internal class NetworkingLinkSignupPreviewParameterProvider :
         payload = Success(
             NetworkingLinkSignupState.Payload(
                 merchantName = "Test",
+                prefilledEmail = null,
                 emailController = EmailConfig.createController("invalid_email.com"),
                 phoneController = PhoneNumberController.createPhoneNumberController(
                     initialValue = "",
                     initiallySelectedCountryCode = null,
                 ),
                 isInstantDebits = false,
+                appVerificationEnabled = false,
                 content = networkingLinkSignupPane(),
             )
         ),
@@ -93,12 +99,14 @@ internal class NetworkingLinkSignupPreviewParameterProvider :
         payload = Success(
             NetworkingLinkSignupState.Payload(
                 merchantName = "Test",
+                prefilledEmail = null,
                 emailController = EmailConfig.createController(initialValue = null),
                 phoneController = PhoneNumberController.createPhoneNumberController(
                     initialValue = "",
                     initiallySelectedCountryCode = null,
                 ),
                 isInstantDebits = true,
+                appVerificationEnabled = false,
                 content = linkLoginPane(),
             )
         ),
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModel.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModel.kt
index 2bb6f76bd17..05329caa0fc 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModel.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModel.kt
@@ -44,6 +44,8 @@ import com.stripe.android.financialconnections.utils.UriUtils
 import com.stripe.android.financialconnections.utils.error
 import com.stripe.android.financialconnections.utils.isCancellationError
 import com.stripe.android.model.ConsumerSessionLookup
+import com.stripe.android.model.EmailSource.CUSTOMER_OBJECT
+import com.stripe.android.model.EmailSource.USER_ACTION
 import com.stripe.android.uicore.elements.EmailConfig
 import com.stripe.android.uicore.elements.InputController
 import com.stripe.android.uicore.elements.PhoneNumberController
@@ -100,12 +102,17 @@ internal class NetworkingLinkSignupViewModel @AssistedInject constructor(
 
             val prefillDetails = elementsSessionContext?.prefillDetails
 
+            val initialEmail = (sync.manifest.accountholderCustomerEmailAddress ?: prefillDetails?.email)
+                ?.takeIf { it.isNotBlank() }
+
             NetworkingLinkSignupState.Payload(
                 content = requireNotNull(content),
                 merchantName = sync.manifest.getBusinessName(),
+                appVerificationEnabled = sync.manifest.appVerificationEnabled,
+                prefilledEmail = initialEmail,
                 emailController = SimpleTextFieldController(
                     textFieldConfig = EmailConfig(label = R.string.stripe_networking_signup_email_label),
-                    initialValue = sync.manifest.accountholderCustomerEmailAddress ?: prefillDetails?.email,
+                    initialValue = initialEmail,
                     showOptionalLabel = false
                 ),
                 phoneController = PhoneNumberController.createPhoneNumberController(
@@ -195,7 +202,7 @@ internal class NetworkingLinkSignupViewModel @AssistedInject constructor(
     /**
      * @param validEmail valid email, or null if entered email is invalid.
      */
-    private suspend fun onEmailEntered(
+    private fun onEmailEntered(
         validEmail: String?
     ) {
         setState { copy(validEmail = validEmail) }
@@ -203,7 +210,12 @@ internal class NetworkingLinkSignupViewModel @AssistedInject constructor(
             logger.debug("VALID EMAIL ADDRESS $validEmail.")
             searchJob += suspend {
                 delay(getLookupDelayMs(validEmail))
-                lookupAccount(validEmail)
+                val payload = stateFlow.value.payload()
+                lookupAccount(
+                    email = validEmail,
+                    emailSource = if (payload?.prefilledEmail == validEmail) CUSTOMER_OBJECT else USER_ACTION,
+                    verifiedFlow = payload?.appVerificationEnabled == true
+                )
             }.execute { copy(lookupAccount = if (it.isCancellationError()) Uninitialized else it) }
         } else {
             setState { copy(lookupAccount = Uninitialized) }
@@ -342,6 +354,8 @@ internal data class NetworkingLinkSignupState(
     data class Payload(
         val merchantName: String?,
         val emailController: SimpleTextFieldController,
+        val appVerificationEnabled: Boolean,
+        val prefilledEmail: String?,
         val phoneController: PhoneNumberController,
         val isInstantDebits: Boolean,
         val content: Content,
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModel.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModel.kt
index 90337dfe901..3f3b9da469a 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModel.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModel.kt
@@ -40,6 +40,7 @@ import com.stripe.android.financialconnections.presentation.FinancialConnections
 import com.stripe.android.financialconnections.repository.ConsumerSessionProvider
 import com.stripe.android.financialconnections.utils.error
 import com.stripe.android.model.ConsumerSession
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.VerificationType
 import com.stripe.android.uicore.elements.IdentifierSpec
 import com.stripe.android.uicore.elements.OTPController
@@ -71,7 +72,6 @@ internal class NetworkingLinkVerificationViewModel @AssistedInject constructor(
         observeAsyncs()
         viewModelScope.launch {
             setState { copy(payload = Loading()) }
-
             runCatching {
                 buildInitData()
             }.onSuccess {
@@ -99,6 +99,7 @@ internal class NetworkingLinkVerificationViewModel @AssistedInject constructor(
         return InitData(
             businessName = manifest.businessName,
             emailAddress = requireNotNull(email),
+            appVerificationEnabled = manifest.appVerificationEnabled,
             initialInstitution = manifest.initialInstitution,
         )
     }
@@ -108,6 +109,8 @@ internal class NetworkingLinkVerificationViewModel @AssistedInject constructor(
     ) {
         lookupConsumerAndStartVerification(
             email = initData.emailAddress,
+            emailSource = EmailSource.CUSTOMER_OBJECT,
+            appVerificationEnabled = initData.appVerificationEnabled,
             businessName = initData.businessName,
             verificationType = VerificationType.SMS,
             onConsumerNotFound = {
@@ -228,6 +231,7 @@ internal class NetworkingLinkVerificationViewModel @AssistedInject constructor(
     private data class InitData(
         val businessName: String?,
         val emailAddress: String,
+        val appVerificationEnabled: Boolean,
         val initialInstitution: FinancialConnectionsInstitution?,
     )
 
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/model/FinancialConnectionsSessionManifest.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/model/FinancialConnectionsSessionManifest.kt
index d4605c0aadd..87897989356 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/model/FinancialConnectionsSessionManifest.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/model/FinancialConnectionsSessionManifest.kt
@@ -72,6 +72,9 @@ internal data class FinancialConnectionsSessionManifest(
     @SerialName(value = "institution_search_disabled")
     val institutionSearchDisabled: Boolean,
 
+    @SerialName(value = "app_verification_enabled")
+    val appVerificationEnabled: Boolean,
+
     @SerialName(value = "livemode")
     val livemode: Boolean,
 
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/presentation/FinancialConnectionsSheetNativeViewModel.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/presentation/FinancialConnectionsSheetNativeViewModel.kt
index 09d5023a004..81c6d133030 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/presentation/FinancialConnectionsSheetNativeViewModel.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/presentation/FinancialConnectionsSheetNativeViewModel.kt
@@ -38,6 +38,7 @@ import com.stripe.android.financialconnections.domain.NativeAuthFlowCoordinator.
 import com.stripe.android.financialconnections.exception.CustomManualEntryRequiredError
 import com.stripe.android.financialconnections.exception.FinancialConnectionsError
 import com.stripe.android.financialconnections.exception.UnclassifiedError
+import com.stripe.android.financialconnections.features.error.isAttestationError
 import com.stripe.android.financialconnections.features.manualentry.isCustomManualEntryError
 import com.stripe.android.financialconnections.launcher.FinancialConnectionsSheetActivityResult
 import com.stripe.android.financialconnections.launcher.FinancialConnectionsSheetActivityResult.Canceled
@@ -307,9 +308,15 @@ internal class FinancialConnectionsSheetNativeViewModel @Inject constructor(
             if (state.completed) {
                 return@launch
             }
-
             setState { copy(completed = true) }
 
+            if (closeAuthFlowError?.isAttestationError() == true) {
+                // Attestation error is a special case where we need to close the native flow
+                // and continue with the AuthFlow on a web browser.
+                finishWithResult(Failed(error = closeAuthFlowError))
+                return@launch
+            }
+
             runCatching {
                 val completionResult = completeFinancialConnectionsSession(earlyTerminationCause, closeAuthFlowError)
                 val session = completionResult.session
diff --git a/financial-connections/src/main/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepository.kt b/financial-connections/src/main/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepository.kt
index 80378469a0e..b0491f50bc8 100644
--- a/financial-connections/src/main/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepository.kt
+++ b/financial-connections/src/main/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepository.kt
@@ -16,6 +16,7 @@ import com.stripe.android.model.ConsumerSessionLookup
 import com.stripe.android.model.ConsumerSessionSignup
 import com.stripe.android.model.ConsumerSignUpConsentAction.EnteredPhoneNumberClickedSaveToLink
 import com.stripe.android.model.CustomEmailType
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.SharePaymentDetails
 import com.stripe.android.model.VerificationType
 import com.stripe.android.repository.ConsumersApiService
@@ -27,17 +28,24 @@ internal interface FinancialConnectionsConsumerSessionRepository {
 
     suspend fun getCachedConsumerSession(): CachedConsumerSession?
 
+    suspend fun postConsumerSession(
+        email: String,
+        clientSecret: String
+    ): ConsumerSessionLookup
+
+    suspend fun mobileLookupConsumerSession(
+        email: String,
+        emailSource: EmailSource,
+        verificationToken: String,
+        appId: String
+    ): ConsumerSessionLookup
+
     suspend fun signUp(
         email: String,
         phoneNumber: String,
         country: String,
     ): ConsumerSessionSignup
 
-    suspend fun lookupConsumerSession(
-        email: String,
-        clientSecret: String
-    ): ConsumerSessionLookup
-
     suspend fun startConsumerVerification(
         consumerSessionClientSecret: String,
         connectionsMerchantName: String?,
@@ -123,15 +131,6 @@ private class FinancialConnectionsConsumerSessionRepositoryImpl(
         consumerSessionRepository.provideConsumerSession()
     }
 
-    override suspend fun lookupConsumerSession(
-        email: String,
-        clientSecret: String
-    ): ConsumerSessionLookup = mutex.withLock {
-        postConsumerSession(email, clientSecret).also { lookup ->
-            updateCachedConsumerSessionFromLookup(lookup)
-        }
-    }
-
     override suspend fun signUp(
         email: String,
         phoneNumber: String,
@@ -238,14 +237,32 @@ private class FinancialConnectionsConsumerSessionRepositoryImpl(
         ).getOrThrow()
     }
 
-    private suspend fun postConsumerSession(
+    override suspend fun postConsumerSession(
         email: String,
         clientSecret: String
     ): ConsumerSessionLookup = financialConnectionsConsumersApiService.postConsumerSession(
         email = email,
         clientSecret = clientSecret,
         requestSurface = requestSurface,
-    )
+    ).also {
+        updateCachedConsumerSessionFromLookup(it)
+    }
+
+    override suspend fun mobileLookupConsumerSession(
+        email: String,
+        emailSource: EmailSource,
+        verificationToken: String,
+        appId: String
+    ): ConsumerSessionLookup = consumersApiService.mobileLookupConsumerSession(
+        email = email,
+        emailSource = emailSource,
+        requestSurface = requestSurface,
+        verificationToken = verificationToken,
+        appId = appId,
+        requestOptions = provideApiRequestOptions(useConsumerPublishableKey = false),
+    ).also {
+        updateCachedConsumerSessionFromLookup(it)
+    }
 
     private fun updateCachedConsumerSession(
         source: String,
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/ApiKeyFixtures.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/ApiKeyFixtures.kt
index 099c096e5cd..cfa45e5d813 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/ApiKeyFixtures.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/ApiKeyFixtures.kt
@@ -59,6 +59,7 @@ internal object ApiKeyFixtures {
         id = "1234",
         instantVerificationDisabled = true,
         institutionSearchDisabled = true,
+        appVerificationEnabled = false,
         livemode = true,
         businessName = "businessName",
         manualEntryUsesMicrodeposits = true,
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerificationTest.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerificationTest.kt
index 84f827e7bc2..8f35faa0c77 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerificationTest.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/domain/LookupConsumerAndStartVerificationTest.kt
@@ -2,6 +2,7 @@ package com.stripe.android.financialconnections.domain
 
 import com.stripe.android.financialconnections.ApiKeyFixtures.consumerSession
 import com.stripe.android.model.ConsumerSessionLookup
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.VerificationType
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.test.runTest
@@ -33,12 +34,20 @@ class LookupConsumerAndStartVerificationTest {
             errorMessage = null,
             consumerSession = null
         )
-        whenever(lookupAccount.invoke(email)).thenReturn(lookup)
+        whenever(
+            lookupAccount(
+                email = email,
+                emailSource = EmailSource.CUSTOMER_OBJECT,
+                verifiedFlow = true
+            )
+        ).thenReturn(lookup)
         var onConsumerNotFoundCalled = false
 
         // Act
         lookupConsumerAndStartVerification(
             email = email,
+            emailSource = EmailSource.CUSTOMER_OBJECT,
+            appVerificationEnabled = true,
             businessName = "Test Business",
             verificationType = VerificationType.EMAIL,
             onConsumerNotFound = { onConsumerNotFoundCalled = true },
@@ -66,7 +75,13 @@ class LookupConsumerAndStartVerificationTest {
             )
             val expectedVerificationType = VerificationType.EMAIL
 
-            whenever(lookupAccount(email)).thenReturn(lookup)
+            whenever(
+                lookupAccount(
+                    email = email,
+                    emailSource = EmailSource.CUSTOMER_OBJECT,
+                    verifiedFlow = true
+                )
+            ).thenReturn(lookup)
             whenever(
                 startVerification.email(
                     consumerSessionClientSecret = consumerSession.clientSecret,
@@ -82,6 +97,8 @@ class LookupConsumerAndStartVerificationTest {
             // Act
             lookupConsumerAndStartVerification(
                 email = email,
+                emailSource = EmailSource.CUSTOMER_OBJECT,
+                appVerificationEnabled = true,
                 businessName = "Test Business",
                 verificationType = expectedVerificationType,
                 onConsumerNotFound = { fail("onConsumerNotFound should not be called") },
@@ -105,12 +122,14 @@ class LookupConsumerAndStartVerificationTest {
         // Arrange
         val email = "test@test.com"
         val expectedException = RuntimeException("Mock lookupAccount exception")
-        whenever(lookupAccount(email)).thenThrow(expectedException)
+        whenever(lookupAccount(email, EmailSource.CUSTOMER_OBJECT, true)).thenThrow(expectedException)
         var onLookupErrorCalled = false
 
         // Act
         lookupConsumerAndStartVerification(
             email = email,
+            emailSource = EmailSource.CUSTOMER_OBJECT,
+            appVerificationEnabled = true,
             businessName = "Test Business",
             verificationType = VerificationType.EMAIL,
             onConsumerNotFound = { fail("onConsumerNotFound should not be called") },
@@ -137,7 +156,7 @@ class LookupConsumerAndStartVerificationTest {
         val expectedVerificationType = VerificationType.EMAIL
         val expectedException = RuntimeException("Mock startVerification exception")
 
-        whenever(lookupAccount(email)).thenReturn(lookup)
+        whenever(lookupAccount(email, EmailSource.CUSTOMER_OBJECT, true)).thenReturn(lookup)
         whenever(
             startVerification.email(
                 consumerSessionClientSecret = consumerSession.clientSecret,
@@ -149,6 +168,8 @@ class LookupConsumerAndStartVerificationTest {
         // Act
         lookupConsumerAndStartVerification(
             email = email,
+            emailSource = EmailSource.CUSTOMER_OBJECT,
+            appVerificationEnabled = true,
             businessName = "Test Business",
             verificationType = expectedVerificationType,
             onConsumerNotFound = { fail("onConsumerNotFound should not be called") },
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModelTest.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModelTest.kt
index 93c4e805ef4..527ec08e471 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModelTest.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinksignup/NetworkingLinkSignupViewModelTest.kt
@@ -96,7 +96,7 @@ class NetworkingLinkSignupViewModelTest {
                 )
             )
         )
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(NetworkingLinkSignupState())
         val state = viewModel.stateFlow.value
@@ -117,7 +117,7 @@ class NetworkingLinkSignupViewModelTest {
                 )
             )
         )
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(),
@@ -201,7 +201,7 @@ class NetworkingLinkSignupViewModelTest {
             )
         )
         whenever(getOrFetchSync().manifest).thenReturn(manifest)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = true))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = true))
 
         val viewModel = buildViewModel(NetworkingLinkSignupState())
 
@@ -236,7 +236,7 @@ class NetworkingLinkSignupViewModelTest {
             )
         )
 
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = true))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = true))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(isInstantDebits = true),
@@ -274,7 +274,7 @@ class NetworkingLinkSignupViewModelTest {
             )
         )
         whenever(getOrFetchSync().manifest).thenReturn(manifest)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = true))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = true))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(),
@@ -368,7 +368,7 @@ class NetworkingLinkSignupViewModelTest {
         )
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(syncResponse)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(isInstantDebits = false),
@@ -402,7 +402,7 @@ class NetworkingLinkSignupViewModelTest {
         )
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(initialSyncResponse)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(isInstantDebits = true),
@@ -436,7 +436,7 @@ class NetworkingLinkSignupViewModelTest {
         )
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(syncResponse)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(isInstantDebits = false),
@@ -470,7 +470,7 @@ class NetworkingLinkSignupViewModelTest {
         )
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(initialSyncResponse)
-        whenever(lookupAccount(any())).thenReturn(ConsumerSessionLookup(exists = false))
+        whenever(lookupAccount(any(), any(), any())).thenReturn(ConsumerSessionLookup(exists = false))
 
         val viewModel = buildViewModel(
             state = NetworkingLinkSignupState(isInstantDebits = true),
@@ -502,7 +502,7 @@ class NetworkingLinkSignupViewModelTest {
         val permissionException = PermissionException(stripeError = StripeError())
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(initialSyncResponse)
-        whenever(lookupAccount(any())).then {
+        whenever(lookupAccount(any(), any(), any())).then {
             throw permissionException
         }
 
@@ -534,7 +534,7 @@ class NetworkingLinkSignupViewModelTest {
         val apiException = APIConnectionException()
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(initialSyncResponse)
-        whenever(lookupAccount(any())).then {
+        whenever(lookupAccount(any(), any(), any())).then {
             throw apiException
         }
 
@@ -566,7 +566,7 @@ class NetworkingLinkSignupViewModelTest {
         val permissionException = PermissionException(stripeError = StripeError())
 
         whenever(getOrFetchSync(anyOrNull(), anyOrNull())).thenReturn(initialSyncResponse)
-        whenever(lookupAccount(any())).then {
+        whenever(lookupAccount(any(), any(), any())).then {
             throw permissionException
         }
 
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModelTest.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModelTest.kt
index 5f5024741fb..dd618cf5844 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModelTest.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/features/networkinglinkverification/NetworkingLinkVerificationViewModelTest.kt
@@ -25,6 +25,7 @@ import com.stripe.android.financialconnections.presentation.Async.Loading
 import com.stripe.android.financialconnections.repository.CachedConsumerSession
 import com.stripe.android.financialconnections.utils.TestNavigationManager
 import com.stripe.android.model.ConsumerSession
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.VerificationType
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.test.runTest
@@ -93,8 +94,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq(consumerSession.emailAddress),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
             businessName = anyOrNull(),
             verificationType = any(),
+            appVerificationEnabled = eq(false),
             onConsumerNotFound = any(),
             onLookupError = any(),
             onStartVerification = any(),
@@ -107,6 +110,7 @@ class NetworkingLinkVerificationViewModelTest {
     fun `init - falls back to accountholder customer email if no consumer session in Instant Debits`() = runTest {
         val manifest = sessionManifest().copy(
             accountholderCustomerEmailAddress = "email@email.com",
+            appVerificationEnabled = true
         )
 
         whenever(getOrFetchSync()).thenReturn(
@@ -120,8 +124,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq("email@email.com"),
-            businessName = anyOrNull(),
-            verificationType = any(),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
+            businessName = eq("businessName"),
+            verificationType = eq(VerificationType.SMS),
+            appVerificationEnabled = eq(true),
             onConsumerNotFound = any(),
             onLookupError = any(),
             onStartVerification = any(),
@@ -147,8 +153,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq(email),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
             businessName = anyOrNull(),
             verificationType = eq(VerificationType.SMS),
+            appVerificationEnabled = eq(false),
             onConsumerNotFound = any(),
             onLookupError = any(),
             onStartVerification = onStartVerificationCaptor.capture(),
@@ -179,8 +187,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq(email),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
             businessName = anyOrNull(),
             verificationType = eq(VerificationType.SMS),
+            appVerificationEnabled = eq(false),
             onConsumerNotFound = onConsumerNotFoundCaptor.capture(),
             onLookupError = any(),
             onStartVerification = any(),
@@ -224,8 +234,10 @@ class NetworkingLinkVerificationViewModelTest {
 
             verify(lookupConsumerAndStartVerification).invoke(
                 email = eq(email),
+                emailSource = eq(EmailSource.CUSTOMER_OBJECT),
                 businessName = anyOrNull(),
                 verificationType = eq(VerificationType.SMS),
+                appVerificationEnabled = eq(false),
                 onConsumerNotFound = any(),
                 onLookupError = any(),
                 onStartVerification = onStartVerificationCaptor.capture(),
@@ -279,8 +291,10 @@ class NetworkingLinkVerificationViewModelTest {
 
             verify(lookupConsumerAndStartVerification).invoke(
                 email = eq(email),
+                emailSource = eq(EmailSource.CUSTOMER_OBJECT),
                 businessName = anyOrNull(),
                 verificationType = eq(VerificationType.SMS),
+                appVerificationEnabled = eq(false),
                 onConsumerNotFound = any(),
                 onLookupError = any(),
                 onStartVerification = onStartVerificationCaptor.capture(),
@@ -320,8 +334,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq(consumerSession.emailAddress),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
             businessName = anyOrNull(),
             verificationType = eq(VerificationType.SMS),
+            appVerificationEnabled = eq(false),
             onConsumerNotFound = any(),
             onLookupError = any(),
             onStartVerification = onStartVerificationCaptor.capture(),
@@ -368,8 +384,10 @@ class NetworkingLinkVerificationViewModelTest {
 
         verify(lookupConsumerAndStartVerification).invoke(
             email = eq(consumerSession.emailAddress),
+            emailSource = eq(EmailSource.CUSTOMER_OBJECT),
             businessName = anyOrNull(),
             verificationType = eq(VerificationType.SMS),
+            appVerificationEnabled = eq(false),
             onConsumerNotFound = any(),
             onLookupError = any(),
             onStartVerification = onStartVerificationCaptor.capture(),
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepositoryImplTest.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepositoryImplTest.kt
index 9053aceebfc..710d9d8c6c6 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepositoryImplTest.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/repository/FinancialConnectionsConsumerSessionRepositoryImplTest.kt
@@ -199,7 +199,7 @@ class FinancialConnectionsConsumerSessionRepositoryImplTest {
         // ensures there's no cached consumer session
         assertThat(repository.getCachedConsumerSession()).isNull()
 
-        val result = repository.lookupConsumerSession(email, clientSecret)
+        val result = repository.postConsumerSession(email, clientSecret)
 
         assertThat(result).isEqualTo(consumerSessionLookup)
 
diff --git a/financial-connections/src/test/java/com/stripe/android/financialconnections/utils/TestHandleError.kt b/financial-connections/src/test/java/com/stripe/android/financialconnections/utils/TestHandleError.kt
index 6cf955879be..fd72cb93fef 100644
--- a/financial-connections/src/test/java/com/stripe/android/financialconnections/utils/TestHandleError.kt
+++ b/financial-connections/src/test/java/com/stripe/android/financialconnections/utils/TestHandleError.kt
@@ -7,7 +7,7 @@ internal class TestHandleError : HandleError {
 
     private val invocations = mutableListOf<HandleErrorInvocation>()
 
-    override fun invoke(
+    override suspend fun invoke(
         extraMessage: String,
         error: Throwable,
         pane: FinancialConnectionsSessionManifest.Pane,
diff --git a/payments-model/src/main/java/com/stripe/android/model/EmailSource.kt b/payments-model/src/main/java/com/stripe/android/model/EmailSource.kt
new file mode 100644
index 00000000000..8f26c8faece
--- /dev/null
+++ b/payments-model/src/main/java/com/stripe/android/model/EmailSource.kt
@@ -0,0 +1,12 @@
+package com.stripe.android.model
+
+import androidx.annotation.RestrictTo
+
+@RestrictTo(RestrictTo.Scope.LIBRARY_GROUP)
+enum class EmailSource(val backendValue: String) {
+    // describes a user-entered email
+    USER_ACTION("user_action"),
+
+    // describes a read-only, merchant-passed email
+    CUSTOMER_OBJECT("customer_object"),
+}
diff --git a/payments-model/src/main/java/com/stripe/android/repository/ConsumersApiService.kt b/payments-model/src/main/java/com/stripe/android/repository/ConsumersApiService.kt
index 343faa09b4e..0a1fbfd2532 100644
--- a/payments-model/src/main/java/com/stripe/android/repository/ConsumersApiService.kt
+++ b/payments-model/src/main/java/com/stripe/android/repository/ConsumersApiService.kt
@@ -16,6 +16,7 @@ import com.stripe.android.model.ConsumerSessionLookup
 import com.stripe.android.model.ConsumerSessionSignup
 import com.stripe.android.model.ConsumerSignUpConsentAction
 import com.stripe.android.model.CustomEmailType
+import com.stripe.android.model.EmailSource
 import com.stripe.android.model.IncentiveEligibilitySession
 import com.stripe.android.model.SharePaymentDetails
 import com.stripe.android.model.VerificationType
@@ -50,6 +51,15 @@ interface ConsumersApiService {
         requestOptions: ApiRequest.Options
     ): ConsumerSessionLookup
 
+    suspend fun mobileLookupConsumerSession(
+        email: String,
+        emailSource: EmailSource,
+        requestSurface: String,
+        verificationToken: String,
+        appId: String,
+        requestOptions: ApiRequest.Options
+    ): ConsumerSessionLookup
+
     suspend fun startConsumerVerification(
         consumerSessionClientSecret: String,
         locale: Locale,
@@ -176,6 +186,36 @@ class ConsumersApiServiceImpl(
         )
     }
 
+    /**
+     * Retrieves the ConsumerSession if the given email is associated with a Link account.
+     */
+    override suspend fun mobileLookupConsumerSession(
+        email: String,
+        emailSource: EmailSource,
+        requestSurface: String,
+        verificationToken: String,
+        appId: String,
+        requestOptions: ApiRequest.Options
+    ): ConsumerSessionLookup {
+        return executeRequestWithModelJsonParser(
+            stripeErrorJsonParser = stripeErrorJsonParser,
+            stripeNetworkClient = stripeNetworkClient,
+            request = apiRequestFactory.createPost(
+                mobileConsumerSessionLookupUrl,
+                requestOptions,
+                mapOf(
+                    "request_surface" to requestSurface,
+                    "email_address" to email.lowercase(),
+                    "android_verification_token" to verificationToken,
+                    "session_id" to "12345", // TODO (carlosmuvi): remove this when we have a real session id
+                    "email_source" to emailSource.backendValue,
+                    "app_id" to appId
+                )
+            ),
+            responseJsonParser = ConsumerSessionLookupJsonParser()
+        )
+    }
+
     /**
      * Triggers a verification for the consumer corresponding to the given client secret.
      */
@@ -328,6 +368,12 @@ class ConsumersApiServiceImpl(
         internal val consumerSessionLookupUrl: String =
             getApiUrl("consumers/sessions/lookup")
 
+        /**
+         * @return `https://api.stripe.com/v1/consumers/mobile/sessions/lookup`
+         */
+        internal val mobileConsumerSessionLookupUrl: String =
+            getApiUrl("consumers/mobile/sessions/lookup")
+
         /**
          * @return `https://api.stripe.com/v1/consumers/sessions/start_verification`
          */