Android

Native Android (Gradle) projects, Groovy or Kotlin DSL.

integrate

For an Android project, alphyn-cli integrate:

1. Resolves the SDK from the Alphyn package registry. It reads the SDK version from the backend manifest but never downloads the AAR: the SDK (com.byterialab:alphyn-sdk) is fetched from the authenticated Alphyn package registry at build time, so nothing is vendored into your project.
2. Registers the registry as a Maven repository where your project’s AGP mode expects it (the dependencyResolutionManagement block in settings.gradle on newer projects, or the root build.gradle on older ones). The repository reads its endpoint and credential from the build environment, so no secret is written into your source. Every edit is bounded by // alphyn:... markers, so it is idempotent and cleanly removable.
3. Adds the SDK dependency implementation("com.byterialab:alphyn-sdk:<version>") and a build hook that auto-registers every APK build (debug and release) with the attestation backend as Gradle packages it.
4. Wires the Application: generates an Application class that initializes the SDK, or inserts the initialization into your existing Application.
5. Records the result in alphyn.json (SDK version and Maven coordinate).

The registry credential is deliberately not written into your project. Supply it at build time as ALPHYN_REGISTRY_KEY, which the repository the CLI wired reads from the environment; the endpoint defaults to the Alphyn registry and is overridable with ALPHYN_REGISTRY_URL. See SDK Registry Access:

export ALPHYN_REGISTRY_KEY=<YOUR_APP_API_KEY>

The CLI does not add permissions; the SDK’s AAR declares the permissions it needs, which Android merges automatically. It does not change your minSdkVersion; doctor advises if it is below the SDK’s minimum.

If your build cannot reach the registry, integrate the self-contained AAR by hand instead: see Manual installation (offline).

register

Registration is automatic. The build hook integrate wires into your app module runs register on every APK build (debug and release) as Gradle packages it, so you normally run nothing; alphyn-cli doctor confirms the hook is present.

Run it by hand only for a build the hook does not cover: a split or App Bundle output (the hook registers a single APK and fails loudly on multiple outputs), or a CI step.

alphyn-cli register --android-api-key <your-key> --apk path/to/app-release.apk

The CLI reads the APK’s package name and version, computes the SHA-256 of its signing certificate (the same value the SDK reports at run time), prints it, and registers it with the attestation endpoint the SDK manifest publishes. The APK must be signed: an unsigned build is re-signed before it can run, so its hash would never match the installed app, and register refuses it.

Because the anchor is the certificate rather than the file, the value is stable across builds signed with the same key, so re-registering an unchanged key is a no-op. Apps distributed through Play App Signing are the exception: Google re-signs the upload with its own key, so the installed app reports a certificate that does not exist locally. Enroll that one by hand with --play-cert; see Play App Signing.

doctor

Confirms the managed Gradle blocks are present and intact (the registry repository still points at the Alphyn registry, the dependency declares the recorded com.byterialab:alphyn-sdk coordinate, and the build hook is in place); the Application is declared and the init block is present as real code; and the recorded SDK coordinate resolves. It also advises if minSdkVersion is below the SDK’s minimum or the arm64-v8a ABI is absent. On a self-contained offline install it additionally verifies the local AAR against the recorded checksum.

remove

Strips the marker-bounded Gradle blocks (the registry repository, the SDK dependency, and the build hook), removes the generated Application (or the init block from your existing one), and removes alphyn.json, restoring every edited file to its pre-integrate state.