Ace ID Android SDK
The Android library provides OIDC sign-in and account/session APIs for native Android apps. Version 0.2.3 is not released yet.
Compatibility
- Namespace:
tab.aid.sdk - Minimum Android: API 23
- Compile SDK: API 36
- Java/Kotlin target: Java 17
- Flow: Authorization Code with PKCE S256
- Artifact: AAR
Sign in
val ace = AceID(
issuer = "https://identity.ace-base.cc",
clientId = BuildConfig.ACE_CLIENT_ID,
redirectUri = "com.example.app:/oauth/callback"
)
lifecycleScope.launch {
val session = ace.login(this@MainActivity)
println(session.user.email)
}Register the exact redirect URI with Ace ID and configure the app to receive it. The callback-based login API is also available for apps that use callbacks rather than coroutines.
Account and tokens
lifecycleScope.launch {
val account = ace.getAccount(this@MainActivity)
val token = ace.getValidAccessTokenAsync(this@MainActivity)
}The SDK coordinates concurrent refresh requests and persists rotated refresh tokens securely.
Session state
The SDK exposes state flows and can be used without Jetpack Compose:
val account by ace.account.collectAsState()
val sessionState by ace.sessionState.collectAsState()Use the relevant lifecycle-aware collection API for the UI framework in your app.
Security
- Authorization Code with PKCE S256 is used for sign-in.
- Callback state and ID-token claims are checked.
- ID-token signatures are verified against the provider's JWKS.
- Discovery metadata is checked against the configured issuer.
- Session data is scoped to the issuer and client ID.
- Client secrets must not be included in Android apps.
Your API must validate access tokens and enforce permissions itself.
Cache defaults
| Setting | Default |
|---|---|
| Transaction TTL | 10 minutes |
| Discovery cache TTL | 6 hours |
| Account cache TTL | 30 seconds |
| Token expiry leeway | 60 seconds |
Build artifacts
The Android workflow builds and tests the library, then uploads an AAR as a workflow artifact. That artifact is for CI inspection and is not a versioned public release.
After the SDK release is approved, use the AAR attached to the official GitHub Release and verify its SHA-256 checksum. Do not distribute an artifact from a feature-branch workflow as a stable SDK release.
Scope
This library handles authentication and account/session operations. AIDC project setup, application provisioning, and CLI configuration are managed separately.