CallingAppInfo

@VisibleForTesting
@DeprecatedSinceApi(api = 28, message = "Use the SigningInfo based constructor instead")
CallingAppInfo(
    packageName: String,
    signatures: List<Signature>,
    origin: String? = null
)

Constructs an instance of CallingAppInfo

@RequiresApi(value = 28)
@VisibleForTesting
CallingAppInfo(
    packageName: String,
    signingInfo: SigningInfo,
    origin: String? = null
)

Constructs an instance of CallingAppInfo

fun getOrigin(privilegedAllowlist: String): String?

Returns the origin of the calling app. This is only non-null if a privileged app like a browser calls Credential Manager APIs on behalf of another application.

Additionally, in order to get the origin, the credential provider must provide an allowlist of privileged browsers/apps that it trusts. This allowlist must be in the form of a valid, non-empty JSON. The origin will only be returned if the packageName and the SHA256 hash of the newest signature obtained from the signingInfo, is present in the privilegedAllowlist.

Packages that are signed with multiple signers will only receive the origin if all of the signatures are present in the privilegedAllowlist.

The format of this privilegedAllowlist JSON must adhere to the following sample.

{"apps": [
   {
      "type": "android",
      "info": {
         "package_name": "com.example.myapp",
         "signatures" : [
         {"build": "release",
             "cert_fingerprint_sha256": "59:0D:2D:7B:33:6A:BD:FB:54:CD:3D:8B:36:8C:5C:3A:
             7D:22:67:5A:9A:85:9A:6A:65:47:FD:4C:8A:7C:30:32"
         },
         {"build": "userdebug",
         "cert_fingerprint_sha256": "59:0D:2D:7B:33:6A:BD:FB:54:CD:3D:8B:36:8C:5C:3A:7D:
         22:67:5A:9A:85:9A:6A:65:47:FD:4C:8A:7C:30:32"
         }]
      }
    }
]}

All keys in the JSON must be exactly as stated in the sample above. Note that if the build for a given fingerprint is specified as 'userdebug', that fingerprint will only be considered if the device is on a 'userdebug' build, as determined by Build.TYPE.

fun isOriginPopulated(): Boolean

Returns true if the origin is populated, and false otherwise.

Note that the origin is only populated if a privileged app like a browser calls Credential Manager APIs on behalf of another application.

val packageName: String

the calling package name of the calling app

lateinit val signingInfo: SigningInfo

the signingInfo associated with the calling app, added at API level 28

val signingInfoCompat: SigningInfoCompat

the signing information associated with the calling app, which can be used across all Android API levels