Skip to main content
Not yet available. The Android SDK is in development and has not been published. There is no Maven or Gradle coordinate to depend on yet, and no release to install. This page describes the shape it is taking so you can plan around it — everything here may change before the first release.Want it sooner, or want to try a pre-release build? Email us.
The Android SDK is the counterpart to the iOS SDK’s App Attest flow. Your app proves it is genuine and unmodified through Google Play Integrity, Grantiva verifies that proof, and your backend receives the same kind of attestation JWT it already knows how to check. No API key is embedded in your release app — the Play Integrity verdict is the authentication.

​
Scope: attestation only

The first release covers attestation and device intelligence. It does not include feature flags, feedback and support tickets, push token registration, or user identity. Don’t plan an Android release around those.

​
Planned requirements

  • minSdk 23 — EncryptedSharedPreferences requires API 23+
  • compileSdk 34, JDK 17
  • Google Play Services on the device for a real Play Integrity verdict

​
What attestation will return

The same three-band risk model the iOS SDK uses, derived from the Play Integrity verdict rather than App Attest: See risk scoring for how the bands map to decisions on your backend.

​
The device ID will not be hardware-bound

This is the one place Android differs materially from iOS, and it affects billing. On iOS the device identity derives from a Secure Enclave key, so it survives app reinstalls. On Android there is no equivalent, so the device ID is a UUID held in encrypted app storage. It is not hardware-bound, which means:
  • A fresh install produces a new device ID
  • The new ID counts as a new device against your Monthly Active Devices quota
Plan for the JWT’s device identifier to be stable per install, not per handset.

​
In the meantime

If you ship on both platforms, start with the iOS SDK — the JWT your backend verifies is the same shape, so the backend verification work carries straight over when Android lands.