> ## Documentation Index
> Fetch the complete documentation index at: https://otpless.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSL Pinning

> Enable SSL certificate pinning on the Android Headless SDK.

SSL pinning locks the SDK to a known, trusted certificate instead of trusting any certificate authority, so a compromised CA or a MITM proxy can't intercept auth traffic.

Available from `otpless-headless-sdk` **v2.0.0**. Pinning is disabled by default, so upgrading needs no code change.

## Enable pinning

Pass `sslKind` to `initialize`:

<CodeGroup>
  ```kotlin Kotlin theme={null}
  import com.otpless.v2.android.sdk.dto.OtplessSslKind

  lifecycleScope.launch(Dispatchers.IO) {
      OtplessSDK.initialize(
          APP_ID,
          this@LoginActivity,
          callback = this@LoginActivity::onOtplessResponse,
          sslKind = OtplessSslKind.SslEnabled
      )
  }
  ```
</CodeGroup>

## `OtplessSslKind` values

| Value         | Behaviour                                     |
| ------------- | --------------------------------------------- |
| `SslDisabled` | No certificate pinning. Default.              |
| `SslEnabled`  | Certificate pinning on all SDK network calls. |

## Pin validation failure

If pin validation fails, `OtplessSDK.start()` returns a terminal response instead of continuing the auth flow:

* `responseType`: `FAILED`
* `statusCode`: `5004`
* `errorCode`: `"5004"`
* `errorMessage`: `"SSL pin validation failed"`

Handle `5004` like any other terminal auth failure: show a fallback or retry path.