Added​

Device groups​

Added support for the device groups feature.

For configuration details, see the Device groups documentation.

Missing authentication method error code​

Added error code serverErrorMissingAuthMethod, which may occur if an authentication method in a device group is deactivated.

Non-blocking support methods​

Added non-blocking versions of the following support methods that accept a callback:

• activatedAuthMethods
• activatedRecoveryMethods
• isActivated
• isRecoveryActivated
• registrationId

Controller initialisation error state​

Added a new Controller.State, ERROR_INITIALIZING, to indicate that controller initialisation failed.

Changed​

Controller initialisation​

Controller initialisation now runs on a background thread to reduce creation time and prevent application not responding (ANR) situations.

Encryption algorithms and keys​

Improved security for compliance with NSM/NIST:

• End-to-end encryption algorithms changed to X25519 and AES-GCM.
• Increased salt encryption key length to 32 and changed algorithm to AES-CTR. No changes in the Android SDK interfaces.

Removed​

Offline authentication​

Removed the offline authentication feature.

Offline authentication error codes​

Removed error codes:

• clientErrorOfflineVersionNotSupported
• clientErrorOfflineParsingFailed

Added​

Risk parameters​

Added the following new risk parameters:

• SSID
• BSSID
• Barometer
• Gravity
• Magnetometer
• IsDeveloperMode
• IsOverlayDetected
• IsProxyEnabled
• IsVpnEnabled
• Locale

Invalid client data error code​

Added the error code clientErrorClientDataInvalid for client data passed to the start authentication operation that:

• Exceeds 1024 bytes when UTF-8 encoded.
• Contains one or more 4-byte UTF-8 characters, including most emojis.

Error code exception classes​

Added the exception class to each ErrorCode entry so you can look up the exception associated with an error code.

Changed​

Recovery method enum entry​

Renamed the recovery method enum entry:

Missing biometrics error code​

Changed the error code returned when the device has no enrolled biometrics to align with iOS:

The SDK still returns clientErrorAuthMethodNotAllowed in cases where an authentication method is being used but is not yet activated, or if not enabled in the server configuration.

Removed​

Authentication required error code​

Removed SDK error code serverErrorAuthenticationRequired.

Added​

Face scan recovery​

Added support for face scan recovery alongside recovery codes, with the enum entry RecoveryMethod.CLOUD_BACKUP_SERVER_SIDE_FACE.

Added the following classes:

• RecoveryParameter
• RecoveryCodeRecoveryParameter
• ServerSideFaceRecoveryParameter

Added the following Controller methods accepting RecoveryParameter:

fun finishAddOrUpdateRecovery(
    recoveryParameter: RecoveryParameter,
    appCallback: AsyncCallback<FinishAddOrUpdateRecoveryResult>
)

fun finishRecovery(
    recoveryParameter: RecoveryParameter,
    activationParameter: ActivationParameter,
    appCallback: AsyncCallback<FinishRecoveryResult>
)

fun finishDeleteRecovery(
    recoveryParameter: RecoveryParameter,
    appCallback: AsyncCallback<FinishDeleteRecoveryResult>
)

Changed​

Kotlin API implementation​

Rewrote the Encap Android API from Java to Kotlin 2.0. It remains backwards compatible with API 3.19 and adds a dependency on kotlin-stdlib version 2.0.

Minimum Android version​

Raised the minimum Android version to Android 9 (API 28).

Deprecated​

Recovery parameters​

Deprecated the EncapRecoveryParameter class and the Controller methods that accept it.

Removed​

Deprecated add or update method​

Removed the deprecated Controller method:

void startAddOrUpdate(
    String clientData,
    AsyncCallback<StartAddOrUpdateResult> callback
);

Already authenticated error code​

Removed SDK error code serverErrorAlreadyAuthenticated.

Outdated Google Play services error handling​

Removed the SDK error code clientErrorGoogleServicesOutdated and the exception class GooglePlayServicesOutdatedException.

Added​

Server-side face authentication​

Added the server-side face authentication method AuthMethod.DEVICE_SERVER_SIDE_FACE.

You can use server-side face authentication to change a forgotten PIN when the end-user has no valid biometrics.

Add or update parameters​

Added the following Controller method:

void startAddOrUpdate(
    @NonNull StartAddOrUpdateParameter startParameter,
    @NonNull AsyncCallback<StartAddOrUpdateResult> callback
);

You can choose the parameter for your use case:

• For server-side face authentication, you can use:

  StartAddOrUpdateParameter(AuthMethod.DEVICE_SERVER_SIDE_FACE)
  

• To pass client data, you can use:

  StartAddOrUpdateParameter(String clientData)
  

Controller nullability annotations​

Added @NonNull and @Nullable annotations to all Controller methods to support Kotlin integration.

Changed​

Minimum Android version​

Raised the minimum Android version to Android 8 (API 26).

Deactivation state​

PROCESSING_DEACTIVATION is now a blocking state. Starting a new operation before deactivation finishes returns clientErrorOperationInProgress.

Missing biometrics error handling​

If biometrics or fingerprint are not enrolled or enabled on the device, the SDK returns BiometricAuthenticationException with clientErrorAndroidBiometricPromptErrorNoBiometrics. This replaces UnexpectedException with clientErrorUnexpected.

Deprecated​

Add or update method​

Deprecated the following Controller method:

void startAddOrUpdate(
    String clientData,
    AsyncCallback<StartAddOrUpdateResult> callback
);

The String clientData argument is made obsolete by the new method accepting:

StartAddOrUpdateParameter(String clientData)

Removed​

Fingerprint authentication​

Removed the fingerprint authentication method AuthMethod.DEVICE_ANDROID_FINGERPRINT. Use AuthMethod.DEVICE_ANDROID_BIOMETRIC_PROMPT instead.

For existing fingerprint users, you can migrate from PIN to Biometric Prompt using addOrUpdate. To migrate from fingerprint to Biometric Prompt, you must use an earlier SDK version.

Added​

Callback nullability annotations​

Added the annotation @NonNull to both the OnSuccess and OnFailure functions of AsyncCallback.

Changed​

Operation context methods​

Renamed the operation context methods in FinishActivationResult and FinishAuthenticationResult to match StartAuthenticationResult and iOS:

Documentation improvements​

• Restructured the documentation to improve usability.
• Rewrote multiple sections.
• Added examples that are easier to copy and paste.

Deprecated​

Fingerprint authentication​

Deprecated fingerprint authentication. It will be removed in a future release.

Added​

Biometric Prompt confirmation​

The Biometric Prompt activation and authentication parameters now expose setConfirmationRequired().

Changed​

Minimum Android version​

Raised the minimum Android version to Android 7.

App attestation​

Replaced the SafetyNet Attestation API with the Play Integrity API.

Removed​

Intermediate push feature​

Removed the intermediate push feature. You must use the Play Integrity API for app attestation instead.

Deprecated authentication method accessors​

Removed the following deprecated API methods:

Added​

Client debug data​

Added the client debug data feature.

The new EncapConfig setting setAllowDebugData is true by default. You can set it to false to prevent a device from sending debug data, even if you have enabled it in your application configuration.

Deprecated​

Authentication method accessors​

Deprecated the following API methods:

Removed​

Fingerprint documentation​

Removed the fingerprint documentation. For new implementations, we recommend using Biometric Prompt.

If you need fingerprint authentication on Android 6–8, we recommend using Biometric Prompt with the AndroidX library.

You can still access the removed fingerprint documentation in an earlier version of this documentation.

Maven documentation​

Removed the documentation about building with Maven. You can still access the removed Maven integration documentation in an earlier version of this documentation.

Fixed​

Deactivation of non-activated registrations​

Deactivating a non-activated registration on the client no longer results in an error.

Upcoming changes​

App attestation​

The SafetyNet Attestation API will be replaced with the Play Integrity API in version 3.17.

Added​

Biometric authentication cancellation​

Added support for cancelling an ongoing biometric authentication for AndroidX BiometricPrompt.

You can cancel an ongoing biometric authentication by supplying a CancellationSignal to the DeviceAndroidBiometricPromptAuthParameter and calling the cancel() method.

The Encap API sets up a listener on the CancellationSignal that calls the cancelAuthentication() method of AndroidX BiometricPrompt.

Changed​

Invalidated authentication data error code​

Replaced the error code clientErrorKeyPermanentlyInvalidated (180) with clientErrorAuthDataInvalidated (132) to align with iOS.

Deprecated​

Intermediate push attestation​

Deprecated intermediate push attestation. It will be removed in a future release.

Added​

Geofencing​

Added the geofencing feature.

The SDK uses an external geocoder service to look up the device location, then sends the country code to the server.

Invalid session error code​

Added the serverErrorInvalidSession error code.

If the server starts a new session after the client calls startAuthenticate, finishAuthenticate returns this error. You need to call startAuthenticate again to start a new authentication attempt.

Changed​

Authenticate and activate operation​

Renamed the AuthenticateAndActivate operation to AddOrUpdate.

On iOS, this operation has always been called AddOrUpdate. The rename aligns the Android and iOS controller interfaces.

Removed​

Signing feature​

Removed the signing feature. If your app uses signing, you must remove calls to its functions.

Removed the following functions and classes:

• EncapConfig.Builder: setSigningEnabled() and setSigningKeySize()
• EncapController: startAuthenticationOrSigning(), startSigning() and FinishSigning()
• EncapController.State: isSigningState()
• PushMessage: isSigningMessage()
• SigningFailedException
• StartSigningResult
• FinishSigningResult

Removed the following error codes:

• serverErrorIncorrectSignature
• serverErrorInvalidSignature