The Android SDK is available in sandbox only. Production support is on the
roadmap.
What you can do
- Approve operations with a passkey: run passkey enrollment and approval for Strong Customer Authentication (SCA) in a Kotlin application.
- Hold the authorization key for non-custodial accounts: the React Native SDK calls this SDK to create the end customer’s authorization key in hardware-backed key storage and sign with it. You don’t call these methods yourself. To build a non-custodial account integration, use the React Native SDK.
Requirements
The SDK depends on
androidx.browser 1.9.0, which requires compile SDK 36 and
Android Gradle Plugin 8.9.1. This doesn’t change your minSdk or targetSdk.
Install
The SDK is distributed from GitHub Packages, which needs a GitHub account to read even public packages. Read the values from environment variables so that no credentials are committed:
Then add the dependency to your application module:
Set up the callback
When a ceremony finishes, Circle’s page returns the result to your application. In an Auth Tab, which Chrome 137 and later supports, the result returns to the SDK directly. In a Custom Tab, it returns through a callback activity that you declare. Set up both, because the end customer’s browser decides which one runs.-
Choose an
httpscallback URL on a domain that you control, such ashttps://app.example.com/sca/callback. The SDK refuses a URL that includes a port or an IP address, and can be up to 2,048 characters. Circle doesn’t accept custom schemes. - Register every exact callback URL that you use in Circle Hub, under Settings > Digital Asset Accounts > SCA. Register separately in sandbox and production.
-
Declare the SDK’s callback activity in your
AndroidManifest.xml, with an intent filter for your callback URL: -
Serve
https://<host>/.well-known/assetlinks.jsonwith thedelegate_permission/common.handle_all_urlsrelation. List the SHA-256 fingerprint of every key that signs your application, including the Play App Signing key and your debug key. Serve it over HTTPS, without redirects, withContent-Type: application/json.
redirectUri when it opens each
passkey registration or challenge. It replaces embedOrigin, which applies only
to web pages. If the value doesn’t exactly match a registered URL, Circle
returns error code 420068.
The ceremony runs only in a supported browser, never in a WebView: Chrome,
Samsung Internet, Firefox, Firefox Focus, Firefox Klar, Edge, Brave, DuckDuckGo,
Opera, Opera Mini, Vivaldi, or Seznam.
Initialize
Create aDaaScaConfig:
An invalid value throws
IllegalArgumentException.
Methods
The SDK runs each ceremony as an activity result contract. Register it withregisterForActivityResult, and launch it with the frame token from your
backend.
DaaScaResult is one of these:
This example approves a transfer. Your backend opens the challenge, returns only
the frame token, and later sends the transfer with the assertion:
transferId in onSaveInstanceState. Android can recreate your activity
while the browser is open.
For the backend steps, see
How-to: Implement Strong Customer Authentication.
Errors
DaaScaResult.Failed carries a DaaScaError:
message is for your logs. Don’t show it to the end customer.