Setup

Get all of this in place before you call connect().

Permissions

The SDK's own manifest declares the Wi-Fi permissions it needs, and they merge into your app automatically:

<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />

Both are install-time permissions, so there's no runtime prompt. You don't add them yourself; they'll just show up in your merged manifest.

Play Integrity

Attestation runs on the Play Integrity API with self-managed response encryption, so Wi-DAS can decrypt and verify your app's integrity tokens on its side. Set it up in the Google Play Console for your app:

1. Enable the Play Integrity API for the app.
2. Link the app to a Google Cloud project and note its project number.
3. Turn on self-managed response encryption and generate the response encryption keys, following Google's Play Integrity setup.

The two response encryption keys

Self-managed response encryption gives you two keys, and Wi-DAS needs both to read the integrity tokens your app produces. Google names them:

Key	What it is	Purpose
Decryption key	A base64-encoded AES key	Decrypts the integrity token.
Verification key	A base64-encoded EC public key	Verifies the token's signature.

Both are provided through the Play Console. Share them with Wi-DAS when you register (see below). Without them, every request fails with AttestationRejected even when the app itself is registered correctly.

The decryption key is a secret

The decryption key is a shared secret: send it to Wi-DAS through the channel your contact gives you, and keep it out of your app and its repository. The verification key is a public key. Neither ever ships in the app.

Cloud project number

Pass your Google Cloud project number when you configure. It's required for builds that aren't distributed through Google Play, such as the internal test builds you side-load while developing:

val widas = WiDAS.configure(
    context = context,
    partnerId = "partner-acme",
    baseUrl = "https://partner-api.wi-das.com/",
    cloudProjectNumber = 123456789L,
)

For Play-distributed builds it's optional, but passing it does no harm and keeps development and production behaving the same way.

The Play App Signing trap

Register Google's app-signing certificate, not your upload certificate

This is the single most common reason production breaks. With Google Play App Signing, Play Integrity attests the certificate Google re-signs your app with, not the upload certificate you sign your build with locally.

Register the upload cert's SHA-256 and every Play-distributed build fails attestation with AttestationRejected, even while a side-loaded debug build signed with the same key sails through.

Grab Google's app-signing certificate SHA-256:

1. Play Console → your app → Test and release → Setup → App signing.
2. Copy the SHA-256 certificate fingerprint under App signing key certificate (not the Upload key certificate).
3. Send that SHA-256 and your package name to your Wi-DAS contact to register against your partnerId.

Register your app with Wi-DAS

Attestation is checked against your registered identity, and Wi-DAS decrypts your tokens with your response encryption keys. Give your Wi-DAS contact all of the following to register against your partnerId:

• your package name,
• your app-signing certificate SHA-256 (from above), and
• your Play Integrity decryption key and verification key (the response encryption keys).

Until that's done, real devices get AttestationRejected / EntitlementMissing.

Checklist

• minSdk ≥ 30
• Play Integrity API enabled, with self-managed response encryption turned on
• Google Cloud project number passed as cloudProjectNumber
• Play Integrity decryption key and verification key shared with Wi-DAS
• App-signing cert SHA-256 (not upload cert) + package name registered against your partnerId
• Testing on a device with Google Play Services

The Entitlements & permissions checklist pulls both platforms together in one place.

Next: Usage.