Prerequisites

- Android Studio 2022.3+ - A running ThunderID instance

Prepare the Android Sample

cd samples/quickstart
cp config.properties.example config.properties

Configure the Android Sample

This sample uses app-native authentication (Flow Execution API), so only the base URL and application ID are required, no OAuth2 client ID or redirect URIs. | Variable | Description | |----------|-------------| | `THUNDERID_BASE_URL` | Base URL of your ThunderID server (HTTPS) | | `THUNDERID_APPLICATION_ID` | Application UUID from ThunderID console | `config.properties` is gitignored. Never commit real credentials. If your ThunderID server is running on `localhost`, don't use `localhost` in `THUNDERID_BASE_URL` directly: - **Emulator**: use `https://10.0.2.2:8090`, the emulator's alias for your host machine's loopback. - **Physical device**: run `adb reverse tcp:8090 tcp:8090` to forward the port over USB and keep using `https://localhost:8090`, or point the URL at your host machine's LAN IP.

Attestation via Google Play Integrity (optional)

If the application enforces Google Play Integrity attestation, set `THUNDERID_ATTESTATION_ENABLED=true` and `THUNDERID_CLOUD_PROJECT_NUMBER` to the number (not the ID) of the Google Cloud project linked to your Play Console app, then rebuild. When enabled, the sample mints a token via `PlayIntegrityTokenProvider` (Play Integrity Standard API) and sends it with every native flow-initiate request. Testing this end-to-end requires: - The app uploaded to a Play Console listing (an internal testing track is enough) with your test device's Google account added as a tester, so Play recognizes the package name and signing certificate. - The Play Integrity API enabled on the linked Google Cloud project. - A release build signed with the certificate registered on the ThunderID application's attestation config (`certificateSha256Digests`), a debug-signed APK will fail the signing-identity check.

Passkeys (WebAuthn)

Passkey registration/authentication via Jetpack Credential Manager (`CreatePublicKeyCredentialRequest`/`GetPublicKeyCredentialOption` in `PasskeyClient`) requires the server's passkey relying party (`rp.id`) to be a real HTTPS domain, not `localhost` or `10.0.2.2`. Android verifies the caller is allowed to use that `rp.id` via **Digital Asset Links**: the domain must serve `https:///.well-known/assetlinks.json` declaring this app's package name and signing certificate SHA-256 fingerprint(s) under `delegate_permission/common.get_login_creds`. Without this, Credential Manager rejects the ceremony. This sample ships `assetlinks.json.example` with a placeholder `sha256_cert_fingerprints` entry for the sample's `applicationId` (`dev.thunderid.Quickstart`). To exercise passkeys end-to-end: 1. Rename/copy `assetlinks.json.example` to `assetlinks.json` and replace `` with the SHA-256 fingerprint of the signing certificate for the build you'll test with (get it via `keytool -list -v -keystore -alias ` or `./gradlew signingReport` for a debug build). 2. Host that file at `https:///.well-known/assetlinks.json`, the domain must serve valid HTTPS (self-signed certs will not work). 3. Make sure the server's passkey `rp.id` matches that same domain, the SDK's `PasskeyClient` passes whatever `rp.id`/relying-party options the server returns straight through to Credential Manager. 4. No `AndroidManifest.xml` change is required for this, unlike iOS's Associated Domains entitlement, Digital Asset Links verification is purely a server-hosted file requirement and does not need an App Links intent filter (this sample doesn't declare one). Exposing a local ThunderID instance under a real, HTTPS-reachable domain (e.g. via a tunnel) is left to you, this sample only wires up the template file/documentation, not the tunnel itself.

Run

Open in Android Studio, sync Gradle, and run on an API 24+ emulator or device.