Skip to content

Conversation

@amalg
Copy link

@amalg amalg commented Jan 3, 2026

Summary

  • Rename package namespace from com.hoker.intra to com.vivokey.intra
  • Replace deprecated /session endpoint with /authenticate for new JWE flow
  • Update getVivokeyJwt() to require devId parameter
  • Remove hardcoded API key from NetworkModule (mobile apps don't need it)
  • Bump version to 2.0.0

Breaking Changes

All imports must be updated from com.hoker.intra.* to com.vivokey.intra.*

API Changes

Old New
getVivokeyJwt(tag) getVivokeyJwt(tag, devId)
/session endpoint /authenticate endpoint
SessionRequest AuthenticateRequest (with dev_id field)
SessionResponse AuthenticateResponse

New Authentication Flow

The new /authenticate endpoint returns encrypted JWEs instead of plain JWTs:

  1. Mobile app calls /challenge to get PCD challenge
  2. Mobile app sends chip response to /authenticate with dev_id
  3. API returns encrypted JWE (opaque to mobile app)
  4. Mobile app sends JWE to server for decryption via /verify

Test plan

  • Build Intra library successfully
  • Build example app successfully
  • Test NFC scanning with VivoKey chip
  • Verify JWE is returned from /authenticate

amalg added 2 commits January 3, 2026 15:18
Breaking Changes:
- Package namespace changed from com.hoker.intra to com.vivokey.intra
- All imports must be updated in consuming applications
- Library version bumped to 2.0.0

API Changes:
- Replace deprecated /session endpoint with /authenticate
- getVivokeyJwt() now requires devId parameter
- Remove SessionRequest/SessionResponse (deprecated)
- Add AuthenticateRequest/AuthenticateResponse for new JWE flow
- NetworkModule now uses api.vivokey.com base URL
- Remove hardcoded API key from NetworkModule (not needed for mobile)

The new /authenticate flow returns encrypted JWEs that must be
decrypted server-side using the paired API key. Mobile apps only
need the developer ID, not the API key.

Updated example app to use new namespace and devId parameter.
The api.vivokey.com endpoint is legacy/decommissioned.
The correct base URL is https://auth.vivokey.com/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants