The Incode Android SDK builds on a set of third-party libraries and services. This page groups them by purpose, not as a full dependency tree. Use it to complete your own privacy review, Google Play Data safety form, or internal SDK inventory.
This page covers only the SDK's own dependencies. Your app may add others. It omits build-only tools, like the Kotlin compiler, Gradle, and annotation processors, since these don't ship in your app. It also omits dependencies used only by the Incode sample app, since the sample app isn't part of the published SDK.
Exact pinned versions change with each release. For the current, per-version list, see the API Changes and dependency sections of the release notes.
How Data Is Handled
Capture and biometric processing happen on the device. The SDK sends capture artifacts and verification requests to the Incode Platform over an encrypted channel. It does not log PII or capture content.
For more detail, see Data Handling and Privacy in the Incode Android SDK Reference and End-to-End Encryption (E2EE).
Capture, Media, and On-Device Processing
| Library | Purpose | Used by |
|---|---|---|
AndroidX CameraX: androidx.camera:* |
Camera capture and preview. | Document Scan, ID Scan, and Selfie Scan |
JPEG2000 decoder: dev.keiji.jp2 |
Decoding the portrait image stored on an NFC chip in an ID. | NFC Scan |
| JMRTD and SCUBA | Standard eMRTD, or electronic passport, chip-reading protocol stack. Supports BAC and PACE protocols. | NFC Scan |
Screen and video recording: HBRecorder |
Recording the video session. | Video Selfie |
The SDK also includes on-device machine-learning models for liveness and presentation-attack detection, face recognition, ID face detection, face occlusion, and age estimation. These are Incode components, shipped as the model-* modules. They run locally on the device.
Networking and Storage
| Library | Purpose |
|---|---|
| Retrofit and OkHttp | HTTP client for requests to the Incode Platform. |
kotlinx.serialization, org.json |
Request and response serialization. |
| Room | Local database. Used for delayed and offline onboarding state. |
| SQLCipher, AndroidX Security Crypto, Google Tink | Standard encryption libraries for on-device data at rest. |
| AndroidX DataStore | Encrypted local preferences and session state. |
Platform Services
| Library or Service | Purpose | Notes |
|---|---|---|
Google Play Services: base, location, and vision. Package: com.google.android.gms:* |
Platform services and device location | Used on devices with Google Play Services. |
| Huawei Mobile Services: location | Device location on Huawei devices without Google Play Services | Selected at runtime when Google Play Services is unavailable. See Dynamic Delivery. |
AndroidX Credentials: androidx.credentials:* |
Adding a credential to Google Wallet | Google Wallet ID and the wallets dependency. |
Contact, Localization, and UI
| Library | Purpose |
|---|---|
libphonenumber: io.michaelrocks:libphonenumber-android |
Phone number parsing and validation. See Phone. |
| Lottie, Paris, Material Components, Accompanist | UI, theming, and animations. See Customization. |
| restring, reword, viewpump | Runtime string localization. |
Real-Time Video
| Library or Service | Purpose |
|---|---|
| OpenTok: Vonage Video | Real-time video conferencing with a remote agent. See Conference (Assisted Video). Pulled in by the video-streaming dependency. |
Telemetry and Diagnostics
| Service | Purpose | Notes |
|---|---|---|
| Statsig | Feature flags and experimentation | Disabled automatically in Capture-Only mode and Delayed mode, also known as offline mode See SDK Modes. |
| Sentry | Crash and error reporting | Can be turned off with setCrashReportingEnabled(false). |
Risk and Antifraud
| Capability | Purpose | Notes |
|---|---|---|
| Device-risk provider | Optional third-party device-risk and antifraud signals | Active only when enabled in your Incode configuration. The SDK works without it if it isn't provisioned. See Antifraud. |
Framework and Utility Libraries
These support the SDK internally. They don't collect end-user data.
- Dependency injection: Dagger, Koin
- Asynchronous and reactive: RxJava 2, Kotlin Coroutines
- Logging: Timber. Timber does not log PII or capture content.
Release Hardening
The SDK's published release artifacts are obfuscated. This happens at build time and doesn't affect the runtime behavior your integration relies on.