Authentication

The SDK sends a bearer token with every request to the Slade ID service. This page explains whose identity that token represents, how to supply it, and the credential gate that protects the reader.

The identity model: you authenticate as the integrator

The SDK is embedded in your application, and your application already has its own users. Slade ID does not know about those users — the identity it cares about is your organisation. Slade ID issues you credentials, and every biometric call is attributed to that integrator.

Supplying credentials

You have two options.

Option A — let the SDK manage the token (recommended)

Give the SDK a clientId / clientSecret that Slade ID issued you; it obtains an access token, caches it, and refreshes it proactively before expiry. You never handle raw tokens.

auth = ClientCredentialsAuth(
    clientId = BuildConfig.SLADEID_CLIENT_ID,
    clientSecret = BuildConfig.SLADEID_CLIENT_SECRET,
    // tokenUrl defaults to the Slade ID identity service; override per environment
)

[!WARNING] The clientSecret lives in the app process. That is acceptable for a controlled device/kiosk, not for an app shipped to untrusted users. Keep it out of source control (inject at build time), and obfuscate release builds. If you cannot trust the device, use Option B with a token minted by your backend.

Option B — supply your own bearer (AuthConfig)

AuthConfig is a fun interface with one suspend method. Return the Authorization header — typically a short-lived bearer your backend minted:

auth = AuthConfig {
    mapOf("Authorization" to "Bearer ${myBackend.freshSladeIdToken()}")
}

The SDK calls getHeaders() on every request, so returning a fresh token here lets you refresh on your own schedule.

The credential gate: no working credentials, no capture

Every SDK function is gated behind a working credential pair — including the device self-test capture().

• Valid credentials → capture proceeds.
• Rejected (401/403) → the SDK emits an AuthError on session.errors, returns null, and never activates the sensor.

Device attribution

The SDK identifies the device automatically for attribution — you don’t configure it. The identifier is derived on-device and sent with each request, separate from the bearer that authenticates you.

Token lifetime

Keep tokens short-lived. ClientCredentialsAuth refreshes proactively (shortly before expiry) and exposes invalidate() to force a re-mint after a hard 401. With Option B, return a fresh short-lived token from your callback and the SDK picks it up on the next request.