Android Headless Lite SDK — Changelog

​

Changed

• OtplessSDK.registerSimBindingMonitor(applicationContext) now returns a Boolean.

​

Added

• SIM binding monitor, to observe SIM binding changes in your app:
  • OtplessSDK.registerSimBindingMonitor(applicationContext) starts monitoring SIM binding changes.
  • OtplessSDK.unregisterSimBindingMonitor(applicationContext) stops monitoring.
  • OtplessSDK.setSimBindingMonitorCallback(callback) sets a listener that is called when the SIM binding is enabled or disabled. Pass null to clear it.

​

Fixed

• Bug fixes and stability improvements.

​

Added

• SIM binding:
  • OtplessSDK.checkSimBindingStatus(applicationContext) returns true when the SIM used to authenticate is still present on the device.
  • OtplessSDK.clearSimBinding(applicationContext) removes the stored SIM binding.

​

Added

• SSL certificate pinning for authentication API calls, configured with the new sslKind parameter of OtplessSDK.initialise(...):
  • OtplessSslKind.SslEnabled turns pinning on.
  • OtplessSslKind.SslDisabled turns it off.
  • OtplessSslKind.CustomSsl(...) uses your own pin configuration.
• New error code 5004. If SSL pin validation fails, start() returns a FAILED response with errorCode 5004 (“SSL pin validation failed”).
• Play Integrity attestation on authentication requests. No integration change is needed.

​

Changed

• Breaking: OtplessSDK.initialise(...) now requires the sslKind parameter. The callback-based OtplessSDK.initialize(...) is unchanged.

​

Fixed

• The SDK now returns AUTH_TERMINATED with an authentication timeout error when delivery succeeds but auto-read does not complete within the timeout period. Applies only to background authentication and SIM binding authentication.

​

Added

• New OtplessSDK.startInBackground(...) for background authentication; auto-read OTPs are auto-submitted for verification instead of firing an OTP_AUTO_READ callback.
• Added deliveredAt (epoch-millis) to delivery-status responses.
• Added a generic error object (errorCode, message, description) alongside snaError on AUTH_TERMINATED responses and SNA VERIFY failures.

​

Added

• Added a snaError object (errorCode, message, description) to AUTH_TERMINATED responses and SNA VERIFY failures, exposing the SNA failure reason.

​

Changed

• Error code 9106 (all-channel auth failed) is now treated as terminal.

​

Changed

• Restored legacy OtplessSDK.initialize(...) as a first-class supported API — the callback-based overload is no longer deprecated.
• Added SIM binding detail in the one-tap response.

​

Changed

• New centralized event pipeline.
• Added mfa_factor_complete response type.
• Improved app information handling during authentication flows.

​

Changed

• Added Multi-Factor Authentication (MFA) support.
• Improved MFA flow handling across authentication channels.
• Enhanced authentication failure handling.
• Added IP pinning for a better SNA success rate.
• New public OTP-customization setters: setDeliveryChannel(...), setOtpLength(...), setExpiry(...).
• Fetch the SIM profile on each auth initiation to get the latest SIM info.

​

Changed

• Added fingerprinting SDK reflection support.
• Added the originating OTP SMS address to the response.
• Added subscription ID parsing for SMS auto-read.

​

Changed

• Improved SDK initialization and startup reliability.

​

Changed

• Enabled library minification (minifyEnabled true) and enhanced Proguard/consumer rules.
• Simplified the public API by removing unnecessary parameters not required for the phone-auth use case.

​

Simplified OtplessRequest

• Removed AuthenticationMedium, locale support, and libphonenumber validation.
• Phone validation is now lightweight digit/length based (E.164-ish 8–15 digits).
• Request JSON generation simplified (phone-number-only path).

​

Refactors / Dependency Trimming

• Refactored code to reduce footprint and improve SDK size.
• Removed appcompat, chucker, googleid (credential manager), and libphonenumber dependencies.
• Added explicit @SerializedName mappings for network models.
• Added consumer Proguard rules for Retrofit and Gson reflection safety.

​

Impact

• Major SDK size reduction.

​

Changed

• Added support for Airtel and the new Vi SNA endpoint.
• Expanded network security configuration allowlist.
• Improved SIM detection logic for dual-SIM devices.
• Internal networking improvements.

​

Based on

• android-headless-sdk: 0.3.7

​

Changed

• Updated internal API contract.

​

Based on

• android-headless-sdk: 0.3.6

​

Changed

• Improved SNA flow.

​

Based on

• android-headless-sdk: 0.3.4

​

Changed

• Fixed immutability-related issues.
• Added enhanced fraud-control improvements.
• Improved SNA flow.

​

Based on

• android-headless-sdk: 0.2.9

​

Changed

• Incorporated bug fixes from Headless SDK 0.2.9.

​

Based on

• android-headless-sdk: 0.2.8

​

Changed

• Incorporated bug fixes from Headless SDK 0.2.8.

​

Based on

• android-headless-sdk: 0.2.7

​

Changed

• Removed Passkey, Google, and Facebook SDK integrations.
• Removed intent-based data classes.
• Removed APIs related to Passkey, Google, and Facebook authentication methods.

​

Impact

• Reduced SDK size by approximately 200 KB.
• Focused Lite SDK on essential authentication flows only.