SSL Pinning - OTPLESS

SSL pinning locks the SDK to a known, trusted certificate instead of trusting any certificate authority, so a compromised CA or a MITM proxy can’t intercept auth traffic. Available from otpless-headless-sdk v2.0.0. Pinning is disabled by default, so upgrading needs no code change.

Enable pinning

Pass sslKind to initialize:

import com.otpless.v2.android.sdk.dto.OtplessSslKind

lifecycleScope.launch(Dispatchers.IO) {
    OtplessSDK.initialize(
        APP_ID,
        this@LoginActivity,
        callback = this@LoginActivity::onOtplessResponse,
        sslKind = OtplessSslKind.SslEnabled
    )
}

`OtplessSslKind` values

Value	Behaviour
`SslDisabled`	No certificate pinning. Default.
`SslEnabled`	Certificate pinning on all SDK network calls.

Pin validation failure

If pin validation fails, OtplessSDK.start() returns a terminal response instead of continuing the auth flow:

responseType: FAILED
statusCode: 5004
errorCode: "5004"
errorMessage: "SSL pin validation failed"

Handle 5004 like any other terminal auth failure: show a fallback or retry path.