Kotlin SDK
The Fyno TOTP (Time-based One-Time Password) SDK is an Android library that provides secure TOTP generation and management capabilities. It handles tenant enrollment, secret key encryption, TOTP generation with configurable algorithms and parameters, and secure key revocation.
Package Name: io.fyno.kotlin-sdk.totp
Min SDK: 23
Target SDK: 33+
Language: Kotlin
Table of Contents
- Installation
- Core Components
- API Reference
- Usage Examples
- Data Models
- Error Handling
- Security Considerations
Installation
Gradle Dependency
Add to your build.gradle file:
Minimum Requirements
- API Level: 23+
- Android SDK: API 33+ for compilation
- Java/Kotlin: Java 8+
Core Components
FynoTOTP Class
The main entry point for all TOTP operations. Handles initialization, tenant management, and OTP generation.
Constructor:
API Reference
init()
Initializes the SDK with workspace and user identifiers.
Signature:
Parameters:
Returns: Unit (asynchronous via callback)
Throws: Exception details passed via Result.failure()
Example:
registerTenant()
Registers a tenant and stores their TOTP secret securely.
Signature:
Parameters:
Returns: Unit (asynchronous via callback)
Throws: Exception details passed via Result.failure()
Notes:
- The TOTP secret is encrypted using Android KeyStore before storage
- The tenant is automatically marked as ACTIVE upon successful registration
- This operation requires API 23+ due to KeyStore requirements
Example:
setConfig()
Sets TOTP configuration parameters for a registered tenant.
Signature:
Parameters:
Returns: Unit (asynchronous via callback)
Throws: Exception details passed via Result.failure()
Notes:
- Tenant must be registered before setting config
- Common algorithms:
SHA1,SHA256,SHA512 - Default values: digits=6, period=30, algorithm=SHA1
Example:
getTotp()
Generates and retrieves the current TOTP code for a tenant.
Signature:
Parameters:
Returns: Unit (asynchronous via callback)
Returns in Callback:
String: TOTP codenull: If tenant is inactive or not found- Exception in
Result.failure()if generation fails
Notes:
- Requires API 23+ (uses KeyStore for decryption)
- Returns
nullif tenant status is INACTIVE - Current server time is used for generation (client-side)
- Generated code changes every 30 seconds (or configured period)
- Automatically decrypts the stored secret
Example:
revokeTenant()
Revokes a tenant’s TOTP enrollment and permanently deletes the stored secret.
Signature:
Parameters:
Returns: Unit (asynchronous via callback)
Throws: Exception details passed via Result.failure()
Example:
Usage Examples
Complete Integration Flow
Periodic OTP Refresh
Data Models
TotpConfig
Configuration model for TOTP generation parameters.
Field Descriptions:
Common Configurations:
Error Handling
Exception Types
The SDK passes exceptions through Result.failure(). Common exceptions include:
Proper Error Handling Pattern
Security Considerations
Encryption
- Storage: TOTP secrets are encrypted using Android KeyStore before being saved to the database
- Algorithm: Uses Android’s default encryption (AES-GCM on API 23+)
- Key Generation: Hardware-backed keys when available
- IV (Initialization Vector): Unique IV generated for each secret and stored separately
Key Management
- Secrets are never stored in plain text
- Keys are stored with
PURPOSE_DECRYPTandPURPOSE_ENCRYPTonly - Biometric authentication can be enforced per-key for additional security
- KeyStore integration requires API 23+
Best Practices
- Always check for null results when calling
getTotp()for inactive tenants - Handle
KeyPermanentlyInvalidatedExceptionafter device unlock changes - Use HTTPS only for tenant registration communication (not handled by SDK)
- Implement timeout logic for OTP input validation
- Do not log or share TOTP secrets in production code
- Regularly audit tenant revocations and enrollments
- Test on both physical and emulated devices for encryption behavior
API Level Considerations
- API < 23: KeyStore encryption unavailable; SDK requires API 23+ for full functionality
- API 23-27: Basic KeyStore support
- API 28+: Enhanced KeyStore features and performance
- API 30+: Biometric integration possible
Database Security
- Database is stored in app-private storage directory
- No sensitive data is cached in SharedPreferences
- All queries use parameterized statements to prevent SQL injection
Changelog
Version 1.0.0
- Initial release
- Core TOTP generation (SHA1, SHA256, SHA512)
- Tenant enrollment and revocation
- Secure secret storage using Android KeyStore
- Support for customizable TOTP parameters
- API 23+ support
Support & Documentation
For additional support, refer to:
- Android KeyStore documentation
- TOTP RFC 6238 specification
- Fyno SDK integration guides
Last Updated: January 2026
SDK Version: 1.0.0
Min API Level: 23
Target API Level: 33+