diff --git a/.changeset/canonical-awaiting-input.md b/.changeset/canonical-awaiting-input.md
new file mode 100644
index 0000000..bc0f2f3
--- /dev/null
+++ b/.changeset/canonical-awaiting-input.md
@@ -0,0 +1,5 @@
+---
+"@onkernel/managed-auth-react": minor
+---
+
+Prefer canonical managed-auth fields and choices when present, submit their stable IDs through `field_values` and `selected_choice_id`, and retain legacy rendering and submission fallbacks during the deprecation window.
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index b261341..b8dafb9 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -41,6 +41,9 @@ jobs:
       - name: Typecheck
         run: bun run typecheck
 
+      - name: Test
+        run: bun run test
+
       # Dry-run npm pack so we catch missing files / bad exports BEFORE a
       # tagged release tries to publish. Exits non-zero if e.g. dist/ is
       # missing from `files` or an export points at a non-existent path.
diff --git a/bun.lock b/bun.lock
index 61be4b1..7d4405e 100644
--- a/bun.lock
+++ b/bun.lock
@@ -7,6 +7,7 @@
       "devDependencies": {
         "@changesets/changelog-github": "0.7.0",
         "@changesets/cli": "^2.27.0",
+        "@types/bun": "1.2.21",
         "@types/node": "^20",
         "prettier": "^3.3.0",
         "typescript": "^5.6.0",
@@ -265,6 +266,8 @@
 
     "@types/babel__traverse": ["@types/babel__traverse@7.28.0", "", { "dependencies": { "@babel/types": "^7.28.2" } }, "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q=="],
 
+    "@types/bun": ["@types/bun@1.2.21", "", { "dependencies": { "bun-types": "1.2.21" } }, "sha512-NiDnvEqmbfQ6dmZ3EeUO577s4P5bf4HCTXtI6trMc6f6RzirY5IrF3aIookuSpyslFzrnvv2lmEWv5HyC1X79A=="],
+
     "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
     "@types/node": ["@types/node@20.19.39", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-orrrD74MBUyK8jOAD/r0+lfa1I2MO6I+vAkmAWzMYbCcgrN4lCrmK52gRFQq/JRxfYPfonkr4b0jcY7Olqdqbw=="],
@@ -297,6 +300,8 @@
 
     "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
 
+    "bun-types": ["bun-types@1.2.21", "", { "dependencies": { "@types/node": "*" }, "peerDependencies": { "@types/react": "^19" } }, "sha512-sa2Tj77Ijc/NTLS0/Odjq/qngmEPZfbfnOERi0KRUYhT9R8M4VBioWVmMWE5GrYbKMc+5lVybXygLdibHaqVqw=="],
+
     "bundle-require": ["bundle-require@5.1.0", "", { "dependencies": { "load-tsconfig": "^0.2.3" }, "peerDependencies": { "esbuild": ">=0.18" } }, "sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA=="],
 
     "cac": ["cac@6.7.14", "", {}, "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="],
diff --git a/package.json b/package.json
index 87a9bbd..b67c1d4 100644
--- a/package.json
+++ b/package.json
@@ -9,6 +9,7 @@
     "build": "bun run --filter '*' build",
     "dev": "bun run --filter '*' dev",
     "typecheck": "bun run --filter '*' typecheck",
+    "test": "bun test",
     "lint": "bun run --filter '*' lint",
     "format": "prettier --write \"**/*.{ts,tsx,js,json,md,css}\"",
     "format:check": "prettier --check \"**/*.{ts,tsx,js,json,md,css}\"",
@@ -18,6 +19,7 @@
   "devDependencies": {
     "@changesets/changelog-github": "0.7.0",
     "@changesets/cli": "^2.27.0",
+    "@types/bun": "1.2.21",
     "@types/node": "^20",
     "prettier": "^3.3.0",
     "typescript": "^5.6.0"
diff --git a/packages/managed-auth-react/src/components/ExternalActionWaiting.tsx b/packages/managed-auth-react/src/components/ExternalActionWaiting.tsx
index 964c2b7..ca54a98 100644
--- a/packages/managed-auth-react/src/components/ExternalActionWaiting.tsx
+++ b/packages/managed-auth-react/src/components/ExternalActionWaiting.tsx
@@ -36,7 +36,7 @@ function getMFAIcon(type: MFAType) {
 interface ExternalActionWaitingProps {
   message?: string | null;
   mfaOptions?: MFAOption[];
-  onMFASelect?: (mfaType: MFAType) => void;
+  onMFASelect?: (mfaType: MFAType, choiceId?: string) => void;
   isLoading?: boolean;
 }
 
@@ -91,11 +91,11 @@ export function ExternalActionWaiting({
         <div className="kma-external-action__alternatives">
           {mfaOptions.map((option, idx) => (
             <Button
-              key={idx}
+              key={option.id ?? `${option.type}:${idx}`}
               variant="secondary"
               slotKey="mfaOption"
               className="kma-option"
-              onClick={() => onMFASelect(option.type)}
+              onClick={() => onMFASelect(option.type, option.id)}
               disabled={isLoading}
             >
               <span
diff --git a/packages/managed-auth-react/src/components/UnifiedAuthForm.tsx b/packages/managed-auth-react/src/components/UnifiedAuthForm.tsx
index 1e8769c..d9323a7 100644
--- a/packages/managed-auth-react/src/components/UnifiedAuthForm.tsx
+++ b/packages/managed-auth-react/src/components/UnifiedAuthForm.tsx
@@ -38,7 +38,7 @@ interface UnifiedAuthFormProps {
   signInOptions?: SignInOption[];
   onSubmitFields: (credentials: Record<string, string>) => void;
   onSSOClick: (ssoButton: SSOButton) => void;
-  onMFASelect: (mfaType: MFAType) => void;
+  onMFASelect: (mfaType: MFAType, choiceId?: string) => void;
   onSignInOptionSelect: (optionId: string) => void;
   isLoading?: boolean;
   errorMessage?: string | null;
@@ -196,11 +196,11 @@ export function UnifiedAuthForm({
     <div className="kma-options">
       {sortedMFAOptions.map((option, idx) => (
         <Button
-          key={idx}
+          key={option.id ?? `${option.type}:${idx}`}
           variant="secondary"
           slotKey="mfaOption"
           className="kma-option"
-          onClick={() => onMFASelect(option.type)}
+          onClick={() => onMFASelect(option.type, option.id)}
           disabled={isLoading}
         >
           <span
diff --git a/packages/managed-auth-react/src/index.ts b/packages/managed-auth-react/src/index.ts
index 29426de..9a62bde 100644
--- a/packages/managed-auth-react/src/index.ts
+++ b/packages/managed-auth-react/src/index.ts
@@ -43,6 +43,9 @@ export type {
   SignInOption,
   FlowStatus,
   FlowStep,
+  ManagedAuthChoice,
+  ManagedAuthChoiceType,
+  ManagedAuthField,
   ManagedAuthResponse,
   UIState,
 } from "./lib/types";
diff --git a/packages/managed-auth-react/src/lib/api.ts b/packages/managed-auth-react/src/lib/api.ts
index 1d995d1..ebee46a 100644
--- a/packages/managed-auth-react/src/lib/api.ts
+++ b/packages/managed-auth-react/src/lib/api.ts
@@ -91,17 +91,20 @@ export async function retrieveManagedAuth(
   return (await res.json()) as ManagedAuthResponse;
 }
 
-interface SubmitBody {
-  fields: Record<string, string>;
+export interface ManagedAuthSubmitBody {
+  field_values?: Record<string, string>;
+  selected_choice_id?: string;
+  fields?: Record<string, string>;
   sso_button_selector?: string;
+  sso_provider?: string;
   mfa_option_id?: MFAType;
   sign_in_option_id?: string;
 }
 
-async function submit(
+export async function submitManagedAuth(
   id: string,
   jwt: string,
-  body: SubmitBody,
+  body: ManagedAuthSubmitBody,
   options?: ApiClientOptions,
 ): Promise<void> {
   const f = getFetch(options);
@@ -119,52 +122,6 @@ async function submit(
   }
 }
 
-export function submitFieldValues(
-  id: string,
-  jwt: string,
-  fields: Record<string, string>,
-  options?: ApiClientOptions,
-): Promise<void> {
-  return submit(id, jwt, { fields }, options);
-}
-
-export function submitSSOButton(
-  id: string,
-  jwt: string,
-  selector: string,
-  options?: ApiClientOptions,
-): Promise<void> {
-  return submit(
-    id,
-    jwt,
-    { fields: {}, sso_button_selector: selector },
-    options,
-  );
-}
-
-export function submitMFASelection(
-  id: string,
-  jwt: string,
-  mfaType: MFAType,
-  options?: ApiClientOptions,
-): Promise<void> {
-  return submit(id, jwt, { fields: {}, mfa_option_id: mfaType }, options);
-}
-
-export function submitSignInOption(
-  id: string,
-  jwt: string,
-  signInOptionId: string,
-  options?: ApiClientOptions,
-): Promise<void> {
-  return submit(
-    id,
-    jwt,
-    { fields: {}, sign_in_option_id: signInOptionId },
-    options,
-  );
-}
-
 /** Callbacks for the SSE event stream. */
 export interface ManagedAuthStreamHandlers {
   onState: (data: ManagedAuthStateEventData) => void;
diff --git a/packages/managed-auth-react/src/lib/types.ts b/packages/managed-auth-react/src/lib/types.ts
index 70c851e..ebb8902 100644
--- a/packages/managed-auth-react/src/lib/types.ts
+++ b/packages/managed-auth-react/src/lib/types.ts
@@ -28,6 +28,8 @@ export type MFAType =
   | "other";
 
 export interface DiscoveredField {
+  id?: string;
+  ref?: string;
   name: string;
   label: string;
   type: "text" | "email" | "password" | "tel" | "code" | "totp";
@@ -38,12 +40,14 @@ export interface DiscoveredField {
 }
 
 export interface SSOButton {
+  id?: string;
   provider: string;
   selector: string;
   label?: string;
 }
 
 export interface MFAOption {
+  id?: string;
   type: MFAType;
   label?: string;
   target?: string;
@@ -56,12 +60,46 @@ export interface SignInOption {
   description?: string | null;
 }
 
+export interface ManagedAuthField {
+  id: string;
+  ref: string;
+  type:
+    | "identifier"
+    | "password"
+    | "code"
+    | "totp_code"
+    | "totp_secret"
+    | "text";
+  label?: string;
+  required?: boolean;
+  observed_selector?: string | null;
+}
+
+export type ManagedAuthChoiceType =
+  | "mfa_method"
+  | "sso_provider"
+  | "sign_in_method"
+  | "auth_method"
+  | "identifier_method"
+  | "account"
+  | "other";
+
+export interface ManagedAuthChoice {
+  id: string;
+  type: ManagedAuthChoiceType;
+  label: string;
+  description?: string | null;
+  observed_selector?: string | null;
+}
+
 export interface ManagedAuthStateEventData {
   event: "managed_auth_state";
   timestamp: string;
   flow_status: FlowStatus;
   flow_step: FlowStep;
   flow_type?: "LOGIN" | "REAUTH";
+  fields?: ManagedAuthField[];
+  choices?: ManagedAuthChoice[];
   discovered_fields?: DiscoveredField[];
   mfa_options?: MFAOption[];
   sign_in_options?: SignInOption[];
@@ -82,6 +120,8 @@ export interface ManagedAuthResponse {
   flow_status: FlowStatus;
   flow_step: FlowStep;
   flow_type?: "LOGIN" | "REAUTH" | null;
+  fields?: ManagedAuthField[] | null;
+  choices?: ManagedAuthChoice[] | null;
   discovered_fields?: DiscoveredField[] | null;
   pending_sso_buttons?: SSOButton[] | null;
   mfa_options?: MFAOption[] | null;
diff --git a/packages/managed-auth-react/src/session/state.test.ts b/packages/managed-auth-react/src/session/state.test.ts
new file mode 100644
index 0000000..cf9fca6
--- /dev/null
+++ b/packages/managed-auth-react/src/session/state.test.ts
@@ -0,0 +1,216 @@
+import { describe, expect, test } from "bun:test";
+import type {
+  ManagedAuthResponse,
+  ManagedAuthStateEventData,
+} from "../lib/types";
+import { mergeStateEvent, normalizeManagedAuthState } from "./state";
+
+function managedAuthState(
+  overrides: Partial<ManagedAuthResponse> = {},
+): ManagedAuthResponse {
+  return {
+    id: "connection-id",
+    domain: "example.com",
+    profile_name: "profile",
+    flow_status: "IN_PROGRESS",
+    flow_step: "AWAITING_INPUT",
+    ...overrides,
+  };
+}
+
+describe("mergeStateEvent", () => {
+  test("clears awaiting-input state omitted from the next snapshot", () => {
+    const base = managedAuthState({
+      fields: [
+        {
+          id: "field_email",
+          ref: "email",
+          type: "identifier",
+          label: "Email",
+        },
+      ],
+      choices: [{ id: "google", type: "sso_provider", label: "Google" }],
+      discovered_fields: [{ name: "email", label: "Email", type: "email" }],
+      pending_sso_buttons: [
+        { provider: "google", selector: "button.google", label: "Google" },
+      ],
+      mfa_options: [{ type: "sms", label: "Text message" }],
+      sign_in_options: [{ id: "work", label: "Work account" }],
+    });
+    const event: ManagedAuthStateEventData = {
+      event: "managed_auth_state",
+      timestamp: "2026-07-28T00:00:00Z",
+      flow_status: "IN_PROGRESS",
+      flow_step: "SUBMITTING",
+    };
+
+    expect(mergeStateEvent(base, event)).toMatchObject({
+      fields: null,
+      choices: null,
+      discovered_fields: null,
+      pending_sso_buttons: null,
+      mfa_options: null,
+      sign_in_options: null,
+    });
+  });
+});
+
+describe("normalizeManagedAuthState", () => {
+  test("uses legacy awaiting-input data when canonical data is absent", () => {
+    const legacy = managedAuthState({
+      discovered_fields: [{ name: "email", label: "Email", type: "email" }],
+      mfa_options: [{ type: "sms", label: "Text message" }],
+      sign_in_options: [{ id: "work", label: "Work account" }],
+    });
+
+    expect(normalizeManagedAuthState(legacy)).toMatchObject({
+      discovered_fields: legacy.discovered_fields,
+      mfa_options: legacy.mfa_options,
+      sign_in_options: legacy.sign_in_options,
+    });
+  });
+
+  test("treats canonical fields and choices as authoritative", () => {
+    const state = managedAuthState({
+      fields: [],
+      choices: [
+        {
+          id: "google",
+          type: "sso_provider",
+          label: "Continue with Google",
+          observed_selector: "button.google",
+        },
+      ],
+      discovered_fields: [
+        { name: "stale", label: "Stale field", type: "text" },
+      ],
+      mfa_options: [{ type: "sms", label: "Stale MFA" }],
+      sign_in_options: [{ id: "stale", label: "Stale account" }],
+    });
+
+    expect(normalizeManagedAuthState(state)).toMatchObject({
+      discovered_fields: null,
+      pending_sso_buttons: [
+        {
+          id: "google",
+          provider: "google",
+          selector: "button.google",
+          label: "Continue with Google",
+        },
+      ],
+      mfa_options: null,
+      sign_in_options: null,
+    });
+  });
+
+  test("preserves canonical MFA identity and the matching legacy destination", () => {
+    const state = managedAuthState({
+      choices: [
+        {
+          id: "sms_code",
+          type: "mfa_method",
+          label: "Text me a code",
+          description: "Six-digit code",
+        },
+        {
+          id: "security_key_vendor",
+          type: "mfa_method",
+          label: "Security key",
+        },
+      ],
+      mfa_options: [
+        {
+          type: "sms",
+          label: "Text me a code",
+          target: "***-***-5678",
+        },
+      ],
+    });
+
+    expect(normalizeManagedAuthState(state).mfa_options).toEqual([
+      {
+        id: "sms_code",
+        type: "sms",
+        label: "Text me a code",
+        target: "***-***-5678",
+        description: "Six-digit code",
+      },
+      {
+        id: "security_key_vendor",
+        type: "other",
+        label: "Security key",
+        target: undefined,
+        description: undefined,
+      },
+    ]);
+  });
+
+  test("projects canonical identifier fields and non-MFA choices into the existing UI model", () => {
+    const state = managedAuthState({
+      fields: [
+        {
+          id: "field_username",
+          ref: "username",
+          type: "identifier",
+          label: "Username",
+        },
+        {
+          id: "field_email",
+          ref: "email",
+          type: "identifier",
+          label: "Email",
+        },
+        {
+          id: "field_phone",
+          ref: "phone_number",
+          type: "identifier",
+          label: "Phone",
+        },
+      ],
+      choices: [
+        {
+          id: "work-account",
+          type: "account",
+          label: "Work account",
+          description: "user@example.com",
+        },
+      ],
+    });
+
+    expect(normalizeManagedAuthState(state)).toMatchObject({
+      discovered_fields: [
+        {
+          id: "field_username",
+          ref: "username",
+          name: "field_username",
+          type: "text",
+          label: "Username",
+          required: true,
+        },
+        {
+          id: "field_email",
+          ref: "email",
+          name: "field_email",
+          type: "email",
+          label: "Email",
+          required: true,
+        },
+        {
+          id: "field_phone",
+          ref: "phone_number",
+          name: "field_phone",
+          type: "tel",
+          label: "Phone",
+          required: true,
+        },
+      ],
+      sign_in_options: [
+        {
+          id: "work-account",
+          label: "Work account",
+          description: "user@example.com",
+        },
+      ],
+    });
+  });
+});
diff --git a/packages/managed-auth-react/src/session/state.ts b/packages/managed-auth-react/src/session/state.ts
new file mode 100644
index 0000000..399fcac
--- /dev/null
+++ b/packages/managed-auth-react/src/session/state.ts
@@ -0,0 +1,182 @@
+import type {
+  DiscoveredField,
+  ManagedAuthChoice,
+  ManagedAuthField,
+  ManagedAuthResponse,
+  ManagedAuthStateEventData,
+  MFAOption,
+  MFAType,
+  SignInOption,
+  SSOButton,
+} from "../lib/types";
+
+export function mergeStateEvent(
+  base: ManagedAuthResponse,
+  event: ManagedAuthStateEventData,
+): ManagedAuthResponse {
+  return {
+    ...base,
+    flow_status: event.flow_status,
+    flow_step: event.flow_step,
+    flow_type: event.flow_type ?? base.flow_type ?? null,
+    fields: event.fields ?? null,
+    choices: event.choices ?? null,
+    discovered_fields: event.discovered_fields ?? null,
+    pending_sso_buttons: event.pending_sso_buttons ?? null,
+    mfa_options: event.mfa_options ?? null,
+    sign_in_options: event.sign_in_options ?? null,
+    external_action_message: event.external_action_message ?? null,
+    website_error: event.website_error ?? null,
+    error_message: event.error_message ?? null,
+    error_code: event.error_code ?? null,
+    post_login_url: event.post_login_url ?? base.post_login_url ?? null,
+    live_view_url: event.live_view_url ?? base.live_view_url ?? null,
+    hosted_url: event.hosted_url ?? base.hosted_url ?? null,
+  };
+}
+
+function fieldTypeToDiscoveredType(
+  field: ManagedAuthField,
+): DiscoveredField["type"] {
+  switch (field.type) {
+    case "identifier": {
+      const ref = field.ref.toLowerCase();
+      if (ref.includes("email")) return "email";
+      if (ref.includes("phone") || ref.includes("tel")) return "tel";
+      return "text";
+    }
+    case "totp_code":
+      return "totp";
+    case "totp_secret":
+      return "text";
+    default:
+      return field.type;
+  }
+}
+
+function fieldsFromCanonical(
+  fields: ManagedAuthField[],
+): DiscoveredField[] | null {
+  if (!fields.length) return null;
+  return fields.map((field) => ({
+    id: field.id,
+    ref: field.ref,
+    name: field.id,
+    type: fieldTypeToDiscoveredType(field),
+    label: field.label || field.ref,
+    required: field.required ?? true,
+  }));
+}
+
+function ssoButtonsFromCanonical(
+  choices: ManagedAuthChoice[],
+): SSOButton[] | null {
+  const buttons = choices
+    .filter((choice) => choice.type === "sso_provider")
+    .map((choice) => ({
+      id: choice.id,
+      provider: choice.id,
+      selector: choice.observed_selector || choice.id,
+      label: choice.label,
+    }));
+  return buttons.length ? buttons : null;
+}
+
+function normalizeMFAChoiceId(id: string): MFAType {
+  switch (id.trim().toLowerCase()) {
+    case "sms_code":
+    case "sms":
+      return "sms";
+    case "email_code":
+    case "email":
+      return "email";
+    case "totp_code":
+    case "totp":
+    case "authenticator":
+    case "authenticator_app":
+      return "totp";
+    case "phone_call":
+    case "call":
+      return "call";
+    case "push":
+      return "push";
+    case "password":
+      return "password";
+    case "passkey":
+      return "passkey";
+    case "switch":
+      return "switch";
+    default:
+      return "other";
+  }
+}
+
+function legacyMFATargets(options: MFAOption[] | null | undefined) {
+  const targets = new Map<MFAType, Array<string | undefined>>();
+  for (const option of options ?? []) {
+    const existing = targets.get(option.type) ?? [];
+    existing.push(option.target);
+    targets.set(option.type, existing);
+  }
+  return targets;
+}
+
+function mfaOptionsFromCanonical(
+  choices: ManagedAuthChoice[],
+  legacyOptions: MFAOption[] | null | undefined,
+): MFAOption[] | null {
+  const targets = legacyMFATargets(legacyOptions);
+  const options = choices
+    .filter((choice) => choice.type === "mfa_method")
+    .map((choice) => {
+      const type = normalizeMFAChoiceId(choice.id);
+      const target = targets.get(type)?.shift();
+      return {
+        id: choice.id,
+        type,
+        label: choice.label,
+        target,
+        description: choice.description ?? undefined,
+      };
+    });
+  return options.length ? options : null;
+}
+
+function signInOptionsFromCanonical(
+  choices: ManagedAuthChoice[],
+): SignInOption[] | null {
+  const options = choices
+    .filter(
+      (choice) =>
+        choice.type !== "sso_provider" && choice.type !== "mfa_method",
+    )
+    .map((choice) => ({
+      id: choice.id,
+      label: choice.label,
+      description: choice.description ?? null,
+    }));
+  return options.length ? options : null;
+}
+
+export function normalizeManagedAuthState(
+  state: ManagedAuthResponse,
+): ManagedAuthResponse {
+  const hasCanonicalFields = state.fields != null;
+  const hasCanonicalChoices = state.choices != null;
+
+  return {
+    ...state,
+    discovered_fields: hasCanonicalFields
+      ? fieldsFromCanonical(state.fields ?? [])
+      : state.discovered_fields,
+    pending_sso_buttons: hasCanonicalChoices
+      ? ssoButtonsFromCanonical(state.choices ?? [])
+      : state.pending_sso_buttons,
+    mfa_options: hasCanonicalChoices
+      ? mfaOptionsFromCanonical(state.choices ?? [], state.mfa_options)
+      : state.mfa_options,
+    sign_in_options: hasCanonicalChoices
+      ? signInOptionsFromCanonical(state.choices ?? [])
+      : state.sign_in_options,
+  };
+}
diff --git a/packages/managed-auth-react/src/session/submission.test.ts b/packages/managed-auth-react/src/session/submission.test.ts
new file mode 100644
index 0000000..0123176
--- /dev/null
+++ b/packages/managed-auth-react/src/session/submission.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, test } from "bun:test";
+import type { ManagedAuthResponse } from "../lib/types";
+import {
+  buildFieldSubmission,
+  buildMFASubmission,
+  buildSignInSubmission,
+  buildSSOSubmission,
+} from "./submission";
+
+function managedAuthState(
+  overrides: Partial<ManagedAuthResponse> = {},
+): ManagedAuthResponse {
+  return {
+    id: "connection-id",
+    domain: "example.com",
+    profile_name: "profile",
+    flow_status: "IN_PROGRESS",
+    flow_step: "AWAITING_INPUT",
+    ...overrides,
+  };
+}
+
+describe("managed auth submissions", () => {
+  test("submits fields through the contract that produced the UI", () => {
+    const values = { field_email: "user@example.com" };
+
+    expect(
+      buildFieldSubmission(managedAuthState({ fields: [] }), values),
+    ).toEqual({ field_values: values });
+    expect(buildFieldSubmission(managedAuthState(), values)).toEqual({
+      fields: values,
+    });
+  });
+
+  test("submits canonical and legacy SSO choices without mixing contracts", () => {
+    expect(
+      buildSSOSubmission({
+        id: "google",
+        provider: "google",
+        selector: "button.google",
+      }),
+    ).toEqual({ selected_choice_id: "google" });
+    expect(
+      buildSSOSubmission({
+        provider: "google",
+        selector: "button.google",
+      }),
+    ).toEqual({ fields: {}, sso_button_selector: "button.google" });
+  });
+
+  test("preserves canonical MFA choice IDs instead of submitting normalized types", () => {
+    expect(buildMFASubmission("other", "security_key_vendor")).toEqual({
+      selected_choice_id: "security_key_vendor",
+    });
+    expect(buildMFASubmission("sms")).toEqual({
+      fields: {},
+      mfa_option_id: "sms",
+    });
+  });
+
+  test("submits sign-in choices through the contract that produced them", () => {
+    expect(
+      buildSignInSubmission(managedAuthState({ choices: [] }), "work-account"),
+    ).toEqual({ selected_choice_id: "work-account" });
+    expect(buildSignInSubmission(managedAuthState(), "work-account")).toEqual({
+      fields: {},
+      sign_in_option_id: "work-account",
+    });
+  });
+});
diff --git a/packages/managed-auth-react/src/session/submission.ts b/packages/managed-auth-react/src/session/submission.ts
new file mode 100644
index 0000000..59a227d
--- /dev/null
+++ b/packages/managed-auth-react/src/session/submission.ts
@@ -0,0 +1,33 @@
+import type { ManagedAuthSubmitBody } from "../lib/api";
+import type { ManagedAuthResponse, MFAType, SSOButton } from "../lib/types";
+
+export function buildFieldSubmission(
+  state: ManagedAuthResponse | null,
+  values: Record<string, string>,
+): ManagedAuthSubmitBody {
+  return state?.fields != null ? { field_values: values } : { fields: values };
+}
+
+export function buildSSOSubmission(button: SSOButton): ManagedAuthSubmitBody {
+  return button.id
+    ? { selected_choice_id: button.id }
+    : { fields: {}, sso_button_selector: button.selector };
+}
+
+export function buildMFASubmission(
+  type: MFAType,
+  choiceId?: string,
+): ManagedAuthSubmitBody {
+  return choiceId
+    ? { selected_choice_id: choiceId }
+    : { fields: {}, mfa_option_id: type };
+}
+
+export function buildSignInSubmission(
+  state: ManagedAuthResponse | null,
+  optionId: string,
+): ManagedAuthSubmitBody {
+  return state?.choices != null
+    ? { selected_choice_id: optionId }
+    : { fields: {}, sign_in_option_id: optionId };
+}
diff --git a/packages/managed-auth-react/src/session/useManagedAuthSession.ts b/packages/managed-auth-react/src/session/useManagedAuthSession.ts
index 1e817c7..dae9a2d 100644
--- a/packages/managed-auth-react/src/session/useManagedAuthSession.ts
+++ b/packages/managed-auth-react/src/session/useManagedAuthSession.ts
@@ -4,10 +4,7 @@ import {
   ManagedAuthApiError,
   retrieveManagedAuth,
   streamManagedAuthEvents,
-  submitFieldValues,
-  submitMFASelection,
-  submitSignInOption,
-  submitSSOButton,
+  submitManagedAuth,
   type ApiClientOptions,
   type ManagedAuthStateEventData,
 } from "../lib/api";
@@ -19,6 +16,13 @@ import type {
   SSOButton,
   UIState,
 } from "../lib/types";
+import { mergeStateEvent, normalizeManagedAuthState } from "./state";
+import {
+  buildFieldSubmission,
+  buildMFASubmission,
+  buildSignInSubmission,
+  buildSSOSubmission,
+} from "./submission";
 
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 15000;
@@ -48,29 +52,6 @@ function isTerminal(uiState: UIState): boolean {
   return uiState === "success" || uiState === "expired" || uiState === "error";
 }
 
-function mergeStateEvent(
-  base: ManagedAuthResponse,
-  ev: ManagedAuthStateEventData,
-): ManagedAuthResponse {
-  return {
-    ...base,
-    flow_status: ev.flow_status,
-    flow_step: ev.flow_step,
-    flow_type: ev.flow_type ?? base.flow_type ?? null,
-    discovered_fields: ev.discovered_fields ?? null,
-    pending_sso_buttons: ev.pending_sso_buttons ?? null,
-    mfa_options: ev.mfa_options ?? null,
-    sign_in_options: ev.sign_in_options ?? null,
-    external_action_message: ev.external_action_message ?? null,
-    website_error: ev.website_error ?? null,
-    error_message: ev.error_message ?? null,
-    error_code: ev.error_code ?? null,
-    post_login_url: ev.post_login_url ?? base.post_login_url ?? null,
-    live_view_url: ev.live_view_url ?? base.live_view_url ?? null,
-    hosted_url: ev.hosted_url ?? base.hosted_url ?? null,
-  };
-}
-
 export interface ManagedAuthSessionOptions extends ApiClientOptions {
   sessionId: string;
   handoffCode: string;
@@ -90,7 +71,7 @@ export interface ManagedAuthSessionValue {
   startFlow: () => void;
   submitFields: (credentials: Record<string, string>) => Promise<void>;
   submitSSO: (button: SSOButton) => Promise<void>;
-  submitMFA: (mfaType: MFAType) => Promise<void>;
+  submitMFA: (mfaType: MFAType, choiceId?: string) => Promise<void>;
   submitSignIn: (optionId: string) => Promise<void>;
 }
 
@@ -167,7 +148,7 @@ export function useManagedAuthSession(
         setSubmitError(null);
         const base = stateRef.current;
         if (!base) return;
-        const merged = mergeStateEvent(base, ev);
+        const merged = normalizeManagedAuthState(mergeStateEvent(base, ev));
         stateRef.current = merged;
         setState(merged);
         const nextUI = deriveUIState(merged);
@@ -214,7 +195,9 @@ export function useManagedAuthSession(
         const gen = generationRef.current;
         if (terminalRef.current) return;
         try {
-          const fresh = await retrieveManagedAuth(sessionId, t, options);
+          const fresh = normalizeManagedAuthState(
+            await retrieveManagedAuth(sessionId, t, options),
+          );
           if (gen !== generationRef.current) return;
           if (terminalRef.current) return;
           stateRef.current = fresh;
@@ -338,7 +321,9 @@ export function useManagedAuthSession(
         );
         if (exchangeRef.current !== ref || !ref.active) return;
         setJwt(token);
-        const initial = await retrieveManagedAuth(sessionId, token, options);
+        const initial = normalizeManagedAuthState(
+          await retrieveManagedAuth(sessionId, token, options),
+        );
         if (exchangeRef.current !== ref || !ref.active) return;
         stateRef.current = initial;
         setState(initial);
@@ -411,7 +396,13 @@ export function useManagedAuthSession(
     async (credentials: Record<string, string>) => {
       if (!jwt) return;
       return submit(
-        () => submitFieldValues(sessionId, jwt, credentials, options),
+        () =>
+          submitManagedAuth(
+            sessionId,
+            jwt,
+            buildFieldSubmission(stateRef.current, credentials),
+            options,
+          ),
         "Failed to submit credentials",
       );
     },
@@ -422,7 +413,13 @@ export function useManagedAuthSession(
     async (button: SSOButton) => {
       if (!jwt) return;
       return submit(
-        () => submitSSOButton(sessionId, jwt, button.selector, options),
+        () =>
+          submitManagedAuth(
+            sessionId,
+            jwt,
+            buildSSOSubmission(button),
+            options,
+          ),
         "Failed to initiate SSO login",
       );
     },
@@ -430,10 +427,16 @@ export function useManagedAuthSession(
   );
 
   const submitMFA = useCallback(
-    async (mfaType: MFAType) => {
+    async (mfaType: MFAType, choiceId?: string) => {
       if (!jwt) return;
       return submit(
-        () => submitMFASelection(sessionId, jwt, mfaType, options),
+        () =>
+          submitManagedAuth(
+            sessionId,
+            jwt,
+            buildMFASubmission(mfaType, choiceId),
+            options,
+          ),
         "Failed to select verification method",
       );
     },
@@ -444,7 +447,13 @@ export function useManagedAuthSession(
     async (optionId: string) => {
       if (!jwt) return;
       return submit(
-        () => submitSignInOption(sessionId, jwt, optionId, options),
+        () =>
+          submitManagedAuth(
+            sessionId,
+            jwt,
+            buildSignInSubmission(stateRef.current, optionId),
+            options,
+          ),
         "Failed to select option",
       );
     },