API Key Rotation

API Key Management

The API keys that are used for SDK initialization may be rotated for security reasons. Please use the Incode dashboard to revoke keys and generate new ones.

Once an API key is revoked from the dashboard, all currently ongoing onboarding sessions that were using that API key are aborted, and the onError(Throwable)/onError(_ error: IncdFlowError) method on the IncodeWelcome.OnboardingListener()/IncdOnboardingDelegate is called. This is the place where you should handle replacing the API key.

Error Handling Code

Android - Kotlin

override fun onError(error: Throwable) {
    if (error is ApiKeyRotationException) {
        // Your logic for the rotation of the key
    }
}

Android - Java

@Override
public void onError(@NonNull Throwable error) {
    if (error instanceof ApiKeyRotationException) {
        // Your logic for the rotation of the key
    }
}

iOS - Swift

func onError(_ error: IncdFlowError) {
    if error == .apiKeyRevoked(let apiKey) { // associated value is the revoked api key
        // Your logic for the rotation of the key
    }
}

SDK Reinitialization

When a new API key has been obtained, the SDK should be reinitialized as such:

Android - Kotlin

IncodeWelcome.Builder(application, apiUrl, apiKeyRotatedIn)
    ... // optional configuration
    .build()
// SDK has been reinitialized successfully

Android - Java

new IncodeWelcome.Builder(getApplication(), apiUrl, apiKeyRotatedIn)
    ... // optional configuration
    .build();
// SDK has been reinitialized successfully

iOS - Swift

IncdOnboardingManager.shared.initIncdOnboarding(url: url, apiKey: newApiKey) { (success, _) in
    // SDK has been reinitialized successfully
}

Once the SDK has been reinitialized successfully, the old session can be restarted, or you can start a completely new onboarding session.