Android onboarding SDK

The fidera-onboarding Android library contains a coroutine-based headless client and reusable Compose UI. It also provides CameraX capture, on-device MRZ recognition, JMRTD passport-chip reading over IsoDep, and AES-GCM session persistence backed by Android Keystore.

Add and initialize

Use the pinned library release, or include platforms/android during local development:

val onboarding = FideraOnboardingClient(
    context = applicationContext,
    baseUrl = "https://verify.fideralabs.com",
)

The API deliberately has no tenant-key parameter. resume() restores an unexpired scoped session. refresh() rotates it. clear() removes session material without deleting the installation identifier used for multi-device tracking.

Configure Android App Links

Register the production package and every release-signing SHA-256 fingerprint in Fidera Settings. The library manifest declares the verified https://verify.fideralabs.com/onboard/ route through OnboardingLinkActivity, which relays a package-scoped ACTION_ONBOARDING_LINK intent.

Receive the intent and exchange it immediately:

lifecycleScope.launch {
    val credential = onboarding.handle(requireNotNull(intent.data))
    val context = onboarding.context()
}

Do not send intent.data to analytics or crash reporting. The capability is in its fragment. Validate the deployed statement:

https://verify.fideralabs.com/.well-known/assetlinks.json

Android App Links open the installed app after verification and use hosted web as the natural fallback otherwise.

Compose and capture

FideraOnboarding renders tenant branding, requirements, semantic progress, capture actions, and neutral completion. Inject navigation for document, selfie, liveness, and NFC screens. CameraCapture provides a CameraX preview and JPEG capture. Request runtime camera permission in the host before rendering it.

MrzRecognizer runs ML Kit locally and MrzParser validates TD3 document, birth-date, and expiry check digits. Keep the captured image: MRZ recognition is a convenience, while server evidence processing is authoritative.

For a passport chip, enable Android reader mode, obtain IsoDep from the NFC tag, and call PassportChipReader.read with the MRZ access key. The reader performs BAC through JMRTD and returns DG1, optional DG2, SOD, and diagnostic hashes. Submit chip evidence for authoritative passive-authentication and trust-chain processing before treating it as chip verified. Optional NFC may fall back to photo/MRZ at lower assurance; required NFC must not.

Retry and resynchronize

Signed upload URLs are short lived. Request a replacement after expiry. Document completion and processing accept stable Idempotency-Key values. Progress updates must send their last-read version. When the API returns 409, replace local progress with error.details.current and retry the action.

Build and test the library with:

./gradlew :fidera-onboarding:testDebugUnitTest
./gradlew :fidera-onboarding:assembleRelease

Review THIRD_PARTY_NOTICES.md and the release dependency report before publishing an AAR.