Android SDK - SpoofSense

The Android SDK opens a full-screen capture activity, captures from the front camera, and submits with device-integrity signals. Distributed via JitPack. You need a clientToken (sst_…) minted by your backend — never embed your secret key in the app.

Install

// settings.gradle.kts
dependencyResolutionManagement {
    repositories { maven("https://jitpack.io") }
}

// build.gradle.kts
implementation("com.github.kartik3ya:spoofsense-android-sdk:v0.1.0")

Launch and handle the result

// In your Activity/Fragment
val verify = registerForActivityResult(SpoofSenseVerification()) { result ->
    when (result) {
        is VerificationResult.Complete -> notifyBackend(result.verificationSessionId)
        is VerificationResult.Failed -> Log.w("spoofsense", result.code)
        VerificationResult.Canceled -> {}
    }
}

verify.launch(SpoofSenseConfig(sessionToken = clientToken))

Result	Meaning
`Complete`	Capture submitted. Send `verificationSessionId` to your backend, which reads the decision with the secret key
`Failed`	Terminal failure — `code` is a standard error code such as `SESSION_EXPIRED` or `TOO_MANY_ATTEMPTS`. Mint a new session to retry
`Canceled`	The user backed out

Behavior notes

Capture comes from the live camera (CameraX); there is no gallery or file input, by design.
The SDK validates the session and fetches its nonce before opening the camera, and handles retryable 422 retakes internally up to the 3-attempt limit.
Device integrity signals ride along with the submission and feed the injection-protection policy.

Complete means “a capture was submitted”, not “the user is verified”. Only your backend’s session read with status: "complete" and decision: "real" means verified.