Showing posts with label Android. Show all posts
Showing posts with label Android. Show all posts

Android App Startup Performance Guide

“First impressions happen in milliseconds — your app’s startup time is the handshake between the user and your code.”

As Android engineers, we often obsess over features, UI polish, and API integration. Yet, one of the most critical (and overlooked) aspects of user experience is how fast your app launches. Users won’t wait long to experience brilliance — a slow start is often a dead start.

This article explores modern strategies and best practices for improving startup performance using the latest Android tools and techniques.


Understanding Startup Phases

Before optimizing, let’s define the types of app starts:

  • Cold Start: App launches fresh — no process in memory.

  • Warm Start: Process exists, but app is not in foreground.

  • Hot Start: App resumes instantly from background.

Cold starts are the most expensive and the main target for optimization.


Measure Before You Optimize

Optimization without metrics is guesswork.
Start by measuring startup time with precision using these tools:

  • Android Studio Profiler → Startup Profiler Tab

  • Macrobenchmark & Baseline Profiles

  • Perfetto and Systrace

  • Firebase Performance Monitoring

Quick CLI check:

adb shell am start -W com.example/.MainActivity

It displays total launch time directly.


Use Baseline Profiles (Game Changer)

A Baseline Profile precompiles critical code paths, reducing startup time by up to 50% on real devices.

Steps to implement:

  1. Add macrobenchmark and baselineprofile dependencies.

  2. Record startup behavior via test.

  3. Bundle baseline-prof.txt with your release build.

Example:

@RunWith(AndroidJUnit4::class)
class StartupBenchmark {
    @get:Rule val benchmarkRule = MacrobenchmarkRule()

    @Test
    fun startup() = benchmarkRule.measureRepeated(
        packageName = "com.example",
        metrics = listOf(StartupTimingMetric()),
        iterations = 5,
        setupBlock = { pressHome() }
    ) {
        startActivityAndWait()
    }
}

Lightweight Application Initialization

Avoid

  • Heavy SDKs in Application.onCreate().

  • Synchronous analytics or DI initialization.

Use

  • Lazy initialization

  • Coroutines on Dispatchers.IO

  • WorkManager for deferred setup

Example:

class MyApp : Application() {
    override fun onCreate() {
        super.onCreate()
        CoroutineScope(SupervisorJob() + Dispatchers.IO).launch {
            initAnalytics()
            initCrashlytics()
        }
    }
}

This keeps your main thread clean and your splash screen quick.


Controlled Initialization with App Startup

Modern Android provides App Startup (AndroidX) for structured initialization.

class AnalyticsInitializer : Initializer<Analytics> {
    override fun create(context: Context): Analytics {
        return Analytics.initialize(context)
    }
    override fun dependencies(): List<Class<out Initializer<*>>> = emptyList()
}

You can control initialization order using:

android:initOrder="2"

Use this to load non-critical SDKs later.


Optimize Dependency Injection (Hilt/Dagger)

DI is powerful but can slow startup if used carelessly.

Tips:

  • Keep eager singletons minimal.

  • Use lazy injection for heavy objects.

  • Avoid large modules initializing in Application scope.

Example:

@InstallIn(SingletonComponent::class)
@Module
object NetworkModule {
    @Provides
    fun provideRetrofit(): Retrofit =
        Retrofit.Builder().baseUrl(BASE_URL).build()
}

Compose UI and Layout Optimization

  • Use Jetpack Compose for faster inflation and less overhead.

  • Keep composition scopes small.

  • Use the SplashScreen API to manage the pre-draw phase gracefully.

Example:

installSplashScreen().setKeepOnScreenCondition {
    viewModel.isLoading.value
}

Preload Smartly

Load just enough data to make the first screen functional:

  • Use Room for cached data.

  • Use DataStore instead of SharedPreferences.

  • Fetch fresh data asynchronously after rendering.


Defer Non-Critical Tasks

Use WorkManager or delayed coroutines for:

  • Crashlytics

  • Analytics

  • Remote Config

  • SDK initializations

Example:

Handler(Looper.getMainLooper()).postDelayed({
    initRemoteConfig()
}, 3000)

Resource & Build Optimization

  • Use R8 + ProGuard for code shrinking.

  • Convert images to WebP.

  • Use VectorDrawables over PNGs.

  • Enable resource shrinking:

    shrinkResources true
    minifyEnabled true
    
  • Deliver via Android App Bundle (AAB) for smaller installs.


Post-Launch Monitoring

After deployment, continuously track:

  • Cold/Warm start times

  • ANR rates

  • Frozen frames

  • Startup crashes

Use Firebase Performance Monitoring or Play Console metrics.


Example Startup Timeline Strategy

Component Strategy Timing
Core DI Graph Lazy load On first need
Analytics Deferred init After 3s
Remote Config Background coroutine After splash
Compose UI Minimal recomposition First frame
Cached Data Room + Coroutine Async load
Baseline Profile Pre-compiled Pre-release

My View as a Sr. Android Engineer

Startup optimization is more than trimming milliseconds — it’s about engineering trust.
When your app launches instantly, it signals quality, reliability, and care.
By combining Baseline Profiles, lazy initialization, and controlled startup sequencing, you ensure that your code performs as thoughtfully as it’s designed.


Analogy

“Startup optimization is like preparing for a long flight — pack essentials in your carry-on and check the rest in later.”


 ๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป

Building Custom Reusable UI Components in Jetpack Compose

The Modern Android Way

“Reusable UI is not just a coding habit — it’s a design philosophy that scales apps, teams, and ideas.”



As Android engineers, we often find ourselves solving the same UI problem over and over — a stylized button, a progress loader, a card with actions. In traditional XML days, we would duplicate layouts or inflate custom views.

But with Jetpack Compose, UI development is declarative, modular, and reactive — a perfect environment for reusable, scalable, and testable components.

In this article, I’ll walk through how to design custom reusable UI components using modern Compose patterns aligned with Clean Architecture and feature modularization — the same structure that powers enterprise-grade fintech apps.


Why Reusable UI Components Matter

Reusable UI is more than DRY (Don’t Repeat Yourself). It enables:

  • Consistency across the app’s look and feel.

  • Scalability, so new features integrate faster.

  • Testability, since each UI piece is independent.

  • Theming flexibility, to support brand-level customization.

  • Faster CI/CD, since UI updates are isolated to one module.


Modular Architecture Overview

Compose works beautifully with modularization.
Here’s a recommended structure for large apps:

app/
 ├── MainActivity.kt
 ├── navigation/
core/
 ├── designsystem/
 │    ├── components/
 │    │    ├── CustomButton.kt
 │    │    ├── CustomProgress.kt
 │    │    ├── CustomCard.kt
 │    ├── theme/
 │    ├── typography/
 ├── utils/
feature/
 ├── dashboard/
 │    ├── ui/
 │    ├── viewmodel/
 │    ├── domain/

Rule of thumb:

  • core/designsystem → Your reusable UI kit (like Material 3 but customized).

  • feature/* → Screens that consume those components.

  • app → Wires navigation and dependency injection.


Step 1: Creating a Reusable Custom Button

Let’s start simple — a custom button that can be reused across modules.

@Composable
fun AppButton(
    text: String,
    onClick: () -> Unit,
    modifier: Modifier = Modifier,
    backgroundColor: Color = MaterialTheme.colorScheme.primary,
    textColor: Color = Color.White,
    enabled: Boolean = true
) {
    Button(
        onClick = onClick,
        modifier = modifier
            .fillMaxWidth()
            .height(56.dp),
        enabled = enabled,
        colors = ButtonDefaults.buttonColors(
            containerColor = backgroundColor,
            contentColor = textColor
        ),
        shape = RoundedCornerShape(12.dp)
    ) {
        Text(
            text = text,
            style = MaterialTheme.typography.labelLarge.copy(fontWeight = FontWeight.Bold)
        )
    }
}

What makes this reusable

  • Parameterized: text, onClick, color, enabled.

  • Styled centrally using your theme.

  • No hardcoded logic — just a pure, stateless composable.


Step 2: Making It Themed & Adaptive

Your core/designsystem/theme defines your app’s brand look:

@Composable
fun AppTheme(content: @Composable () -> Unit) {
    MaterialTheme(
        colorScheme = lightColorScheme(
            primary = Color(0xFF1565C0),
            secondary = Color(0xFF64B5F6)
        ),
        typography = Typography,
        content = content
    )
}

Now, every AppButton automatically aligns with the theme colors and typography across your app.


Step 3: Building a Custom Progress Indicator

Let’s add a reusable loading animation with Compose’s Canvas:

@Composable
fun AppProgressBar(
    progress: Float,
    modifier: Modifier = Modifier,
    color: Color = MaterialTheme.colorScheme.primary,
    strokeWidth: Dp = 6.dp
) {
    Canvas(modifier = modifier.size(100.dp)) {
        val sweepAngle = 360 * progress
        drawArc(
            color = color,
            startAngle = -90f,
            sweepAngle = sweepAngle,
            useCenter = false,
            style = Stroke(width = strokeWidth.toPx(), cap = StrokeCap.Round)
        )
    }
}

Reusable Advantage:
This progress bar can be dropped into any screen — dashboard loading, biometric scanning, or file uploads — without extra setup.


Step 4: Adding Motion and State

Composable components are state-driven. Let’s animate progress reactively:

@Composable
fun AnimatedProgress(targetValue: Float) {
    val progress by animateFloatAsState(
        targetValue = targetValue,
        animationSpec = tween(1500)
    )
    AppProgressBar(progress = progress)
}

Every change to targetValue triggers an animation — clean, declarative, and side-effect-safe.


Step 5: Composable Composition

Compose encourages composition over inheritance. You can easily compose smaller reusable elements:

@Composable
fun AppCard(
    title: String,
    subtitle: String,
    icon: ImageVector,
    onClick: () -> Unit
) {
    Row(
        modifier = Modifier
            .fillMaxWidth()
            .clip(RoundedCornerShape(16.dp))
            .background(MaterialTheme.colorScheme.surfaceVariant)
            .clickable { onClick() }
            .padding(16.dp),
        verticalAlignment = Alignment.CenterVertically
    ) {
        Icon(icon, contentDescription = null, tint = MaterialTheme.colorScheme.primary)
        Spacer(Modifier.width(12.dp))
        Column {
            Text(title, style = MaterialTheme.typography.titleMedium)
            Text(subtitle, style = MaterialTheme.typography.bodySmall)
        }
    }
}

Now your feature modules can combine AppCard, AppButton, and AppProgressBar to build complex UIs effortlessly.


Step 6: Integrating Reusable Components in Features

In your feature module (e.g., Dashboard):

@Composable
fun DashboardScreen(viewModel: DashboardViewModel = hiltViewModel()) {
    val uiState by viewModel.uiState.collectAsState()

    when (uiState) {
        is UiState.Loading -> AnimatedProgress(0.7f)
        is UiState.Success -> AppCard(
            title = "Balance",
            subtitle = "$12,450.00",
            icon = Icons.Default.AttachMoney,
            onClick = { /* Navigate */ }
        )
        is UiState.Error -> AppButton("Retry", onClick = viewModel::fetchData)
    }
}

The result: clean, modular, theme-aware UIs that require no repetitive logic.


Step 7: Accessibility and Testing

Accessibility should never be an afterthought. Compose makes it simple:

Modifier.semantics {
    contentDescription = "Loading ${progress * 100}%"
}

For testing:

@get:Rule val composeTestRule = createComposeRule()

@Test
fun testButtonDisplaysText() {
    composeTestRule.setContent { AppButton("Submit", onClick = {}) }
    composeTestRule.onNodeWithText("Submit").assertExists()
}

Design System Philosophy

Think of your core/designsystem as a mini Material library for your brand.
When a designer updates the theme or typography, every screen reflects it automatically.

That’s how large teams scale UI with confidence — Compose turns UI consistency into an architectural feature.


Key Takeaways

Principle Description
Stateless Composables Avoid internal logic; take data via parameters.
Theming Define global color, shape, and typography systems.
Composition > Inheritance Build larger components from smaller ones.
Accessibility Always use semantics for TalkBack support.
Testing Use ComposeTestRule for UI validation.
Modularity Keep your design system separate from features.

My Thoughts

As Android engineers, our UI should evolve as fast as user expectations.
Jetpack Compose gives us the freedom to innovate — while modular architecture keeps our codebase structured and scalable.

Reusable UI isn’t just a best practice; it’s a strategy for sustainable growth in modern Android apps.

“Compose taught us that great UIs aren’t built — they’re composed.”



๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป

Functional vs Non-Functional Requirements in Modern Android App Development

A Senior Android Engineer’s Guide to Building Reliable, Scalable, and Delightful Apps

“Great apps don’t just work — they feel right.”



In modern Android app development, success isn’t measured only by what your app does (features), but also by how it performs, scales, and delights users.

That’s where Functional and Non-Functional Requirements (NFRs) come into play.

Functional requirements define what the system should do — the visible behaviors and actions.
Non-functional requirements define how the system should behave — the invisible qualities that separate a mediocre app from a world-class product.

Let’s explore both through real-world Android use cases, best practices, and architecture principles.


Functional Requirements — The “What”

These describe the core features and interactions users directly experience.
They define the app’s functional capabilities — tasks, data processing, business rules, and UI behaviors.

Examples in Android

  1. User Authentication

    • Sign-in with biometric, PIN, or OAuth (e.g., Google, Schwab Secure Login).

    • Use BiometricPrompt API and Jetpack Security for encryption.

  2. Data Fetching & Display

    • Fetch real-time stock prices using Retrofit + Coroutines + Flow.

    • Display data using Jetpack Compose with sealed UI states (Loading, Success, Error).

  3. Offline Mode

    • Cache the latest currency or weather data using Room or DataStore.

    • Sync changes when the device is online using WorkManager.

  4. Push Notifications

    • Implement FCM for trade alerts or balance updates.

    • Handle foreground and background states gracefully.

  5. Accessibility & Localization

    • Support TalkBack, font scaling, and dynamic color theming.

    • Provide localized strings (en, es, ne) with Android’s resources/values structure.

Best Practices

  • Follow MVVM Clean Architecture for modular, testable design.

  • Use sealed classes for predictable UI state management.

  • Use Kotlin Coroutines + Flow for structured concurrency and reactive data flow.

  • Validate business logic in the domain layer, not UI.


Non-Functional Requirements — The “How”

These define the quality attributes that make your app performant, secure, scalable, and user-friendly.

They often determine whether the app succeeds in real-world conditions.

Common Non-Functional Aspects

Category Description Android Example
Performance App speed, memory use, responsiveness Optimize recompositions in Jetpack Compose using remember and stable keys
Security Data protection, secure communication Use EncryptedSharedPreferences, TLS 1.3, certificate pinning
Scalability Ability to handle growing users/data Modular architecture + Repository pattern
Reliability Stability under various network or device conditions Use Retry strategies with Flow.retryWhen()
Usability UX clarity and accessibility Material 3 components, motion transitions, accessible color contrast
Maintainability Ease of code updates and testing Follow SOLID, Clean Architecture, Dependency Injection via Hilt
Compatibility Support for different Android API levels & devices Leverage backward compatibility libraries (AppCompat, Core KTX)
Observability Logs, crash monitoring, metrics Integrate Firebase Crashlytics, Macrobenchmark, or Perfetto

Use Case 1 — Mobile Banking App

Functional:

  • Biometric login

  • Fund transfer

  • Real-time transaction updates

Non-Functional:

  • End-to-end encryption (TLS + Keystore)

  • PCI-DSS compliance for card data

  • Low latency (under 200ms API response time)

  • Smooth UI transitions (Compose animation APIs)

Best Practice:

  • Use WorkManager for secure background synchronization.

  • Employ Hilt for dependency management across features.

  • Implement ProGuard & R8 for obfuscation.


Use Case 2 — Trading App (Thinkorswim-like Example)

Functional:

  • Real-time stock charts

  • Trade placement

  • Watchlist synchronization

Non-Functional:

  • High throughput WebSocket connections

  • Optimized rendering with custom Canvas charts

  • Security: Token encryption via Jetpack Security

  • Accessibility for visually impaired traders (TalkBack + custom semantics)

Best Practice:

  • Use Coroutines + Channels for WebSocket streams.

  • Employ Macrobenchmark to test frame drops during chart updates.

  • Build with modular architecture: core-network, core-ui, feature-trade, feature-watchlist.


Modern Best Practices for Balancing Both

Principle Description
Shift-Left Quality Consider NFRs early in the development cycle.
CI/CD Automation Integrate Lint, Detekt, Unit/UI tests in Jenkins or Bitrise.
Structured Concurrency Use viewModelScope and SupervisorJob for predictable task cancellation.
Jetpack Compose Performance Tuning Use derivedStateOf, LaunchedEffect, and smart recomposition strategies.
Monitoring & Observability Integrate Firebase Performance, ANR Watchdog, and custom metrics.

Final Thoughts

Functional requirements define your product’s purpose, while non-functional requirements define its quality and soul.

As a Senior Android Engineer, your mission is to deliver both:

  • Features that users love, and

  • Experiences that feel fast, safe, and delightful.

“An app may function well, but it only thrives when it’s performant, secure, and inclusive.”
— Dharma Kshetri


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป


Structured Concurrency in Android

“Concurrency without structure is chaos. Structured concurrency makes coroutines predictable, safe, and lifecycle-aware.”

As Android engineers, we juggle multiple tasks: fetching API data, updating UI, caching results, syncing offline data, and handling user interactions—all happening asynchronously. Without proper management, this can lead to leaks, zombie coroutines, or even crashes.

This is where Structured Concurrency in Kotlin comes in. It enforces scoped, hierarchical coroutine management that aligns perfectly with Android lifecycles.


 What is Structured Concurrency?

Structured concurrency means that every coroutine has a parent scope, and when the parent is canceled (e.g., Activity destroyed, ViewModel cleared), all its child coroutines are automatically canceled.

Instead of launching fire-and-forget coroutines (like GlobalScope.launch), structured concurrency ensures:

  • Lifecycle awareness: Coroutines cancel when their UI component dies.

  • Error propagation: Exceptions bubble up to parent scopes.

  • Predictable flow: All children complete or cancel together.


 Building Blocks in Android

1. CoroutineScope

Defines the lifecycle boundary for coroutines.

  • viewModelScope → Tied to ViewModel lifecycle.

  • lifecycleScope → Tied to Activity/Fragment lifecycle.

  • rememberCoroutineScope → For Composables.

class MyViewModel : ViewModel() {
    fun fetchData() {
        viewModelScope.launch {
            val data = repository.getData()
            _uiState.value = data
        }
    }
}

2. Job & SupervisorJob

  • Job: Cancels all child coroutines when canceled.

  • SupervisorJob: Allows siblings to fail independently.

val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main)

3. Coroutine Builders

  • launch { } → Fire-and-forget.

  • async { } → Returns Deferred<T> result, use await().

  • withContext { } → Switch dispatcher safely.

  • coroutineScope { } → Ensures children complete or cancel as a group.


 Real-World Use Cases in Android

1. Safe API Calls in ViewModel

class UserViewModel(private val repo: UserRepository) : ViewModel() {
    val userState = MutableStateFlow<User?>(null)

    fun loadUser() {
        viewModelScope.launch {
            try {
                val user = repo.fetchUser()
                userState.value = user
            } catch (e: IOException) {
                // Handle error gracefully
            }
        }
    }
}

 When the ViewModel clears, viewModelScope cancels the coroutine, preventing memory leaks.


2. Parallel Requests with async

suspend fun fetchProfileAndPosts() = coroutineScope {
    val profile = async { api.getProfile() }
    val posts = async { api.getPosts() }
    profile.await() to posts.await()
}

 If one request fails, both are canceled, avoiding inconsistent UI states.


3. With Timeout

withTimeout(5000) {
    repository.syncData()
}

 Cancels automatically if it takes longer than 5 seconds.


 4. In Jetpack Compose

@Composable
fun UserScreen(repo: UserRepository) {
    val scope = rememberCoroutineScope()
    var name by remember { mutableStateOf("") }

    Button(onClick = {
        scope.launch {
            name = repo.getUser().name
        }
    }) {
        Text("Load User")
    }
}

When the Composable leaves the composition, rememberCoroutineScope is canceled.


 Error Handling in Structured Concurrency

Centralized Exception Handling

val handler = CoroutineExceptionHandler { _, exception ->
    Log.e("CoroutineError", "Caught: $exception")
}

val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main + handler)

Supervisor Scope Example

suspend fun safeParallelCalls() = supervisorScope {
    val first = launch { riskyCall1() }
    val second = launch { riskyCall2() }
    // If one fails, the other keeps running
}

 Best Practices for Android Engineers

  1. Never use GlobalScope → Causes leaks and unmanaged coroutines.

  2. Always tie to lifecycle → Use viewModelScope, lifecycleScope, or rememberCoroutineScope.

  3. Use coroutineScope or supervisorScope for child tasks.

  4. Use Dispatchers wisely:

    • Main → UI updates.

    • IO → Network/database.

    • Default → CPU-intensive tasks.

  5. Write tests with runTest or TestCoroutineDispatcher.

  6. Handle cancellation properly (isActive, ensureActive()).


Analogy: Family Trip 


Think of structured concurrency like a family trip:
  • The parent (scope) starts the trip.

  • All kids (child coroutines) must stick together.

  • If the parent says "Trip’s over," everyone goes home.

  • No child keeps wandering alone (no leaks).


Closing Thoughts

Structured concurrency is not just a Kotlin feature—it’s a mindset. It brings discipline to concurrency, making apps safer, cleaner, and more maintainable.

As Android engineers, embracing structured concurrency ensures our coroutines don’t outlive their purpose, keeping apps fast, stable, and memory-leak free.


- By following these practices, you’ll write modern, production-ready Android code with Kotlin coroutines that scales across features, modules, and teams.


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป




Token Management in Android App Development: Best Practices for Engineers

As Android engineers, we’re constantly building apps that need to securely authenticate users and interact with backend APIs. One of the most critical parts of this puzzle is token management — making sure authentication is safe, seamless, and user-friendly.


 What is a Token?

A token is a digital key that grants access to protected resources (like APIs). Instead of repeatedly sending usernames and passwords (insecure and inefficient), the client app uses tokens to prove identity and permissions.

Tokens usually come in two flavors:

  • Access Token – short-lived, used for every API request.

  • Refresh Token – longer-lived, used to obtain a new access token once it expires.

Think of an access token as a hotel room key card and the refresh token as your hotel booking record. If your key card stops working, the receptionist (auth server) issues a new one, as long as your booking is valid.


Token Lifecycle in Android

Here’s the typical flow:

  1. Login – User authenticates with email/password/biometric → server issues access + refresh token.

  2. Store Securely – Tokens are stored securely on-device.

  3. Use in Requests – Access token is attached to each API call.

  4. Refresh When Expired – On 401 Unauthorized, refresh token is used to fetch a new access token.

  5. Logout – Tokens are cleared.

 Visual Flow:


 Best Practices for Token Management

  1. Use Access + Refresh Token Strategy

    • Access tokens: short-lived.

    • Refresh tokens: long-lived but securely stored.

  2. Secure Storage

    • Use EncryptedSharedPreferences / Encrypted DataStore.

    • Use Android Keystore for refresh tokens (hardware-backed security).

    • Keep access token in memory only to reduce exposure.

  3. Automatic Token Handling

    • Use OkHttp Interceptor to attach tokens.

    • Use OkHttp Authenticator to refresh tokens when expired.

    • Never manually add tokens in API calls.

  4. Follow Clean Architecture

    • Keep token logic in Data layer.

    • Expose login/refresh/logout via Use Cases (Domain layer).

    • UI observes AuthState from ViewModel.

  5. Security Best Practices

    • Always use HTTPS (TLS).

    • Never log tokens.

    • Force logout if refresh fails.

    • Test token expiration scenarios.


 Example Implementation in Android

Retrofit API

interface AuthApi {
    @POST("auth/login")
    suspend fun login(@Body request: LoginRequest): TokenResponse

    @POST("auth/refresh")
    suspend fun refreshToken(@Body request: RefreshRequest): TokenResponse
}

Token Storage

class TokenStorage(private val context: Context) {
    private val Context.dataStore by preferencesDataStore("secure_prefs")
    private val ACCESS_TOKEN = stringPreferencesKey("access_token")
    private val REFRESH_TOKEN = stringPreferencesKey("refresh_token")

    suspend fun saveTokens(access: String, refresh: String) {
        context.dataStore.edit {
            it[ACCESS_TOKEN] = access
            it[REFRESH_TOKEN] = refresh
        }
    }

    suspend fun getAccessToken() = context.dataStore.data.first()[ACCESS_TOKEN]
    suspend fun getRefreshToken() = context.dataStore.data.first()[REFRESH_TOKEN]
    suspend fun clearTokens() = context.dataStore.edit { it.clear() }
}

OkHttp Interceptor

class AuthInterceptor(private val tokenProvider: TokenProvider) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        val token = tokenProvider.getAccessToken()
        val newRequest = chain.request().newBuilder()
            .addHeader("Authorization", "Bearer $token")
            .build()
        return chain.proceed(newRequest)
    }
}

OkHttp Authenticator (Auto Refresh)

class TokenAuthenticator(private val repo: AuthRepository) : Authenticator {
    override fun authenticate(route: Route?, response: Response): Request? {
        return runBlocking {
            if (repo.refreshToken()) {
                repo.getAccessToken()?.let { newToken ->
                    response.request.newBuilder()
                        .header("Authorization", "Bearer $newToken")
                        .build()
                }
            } else null
        }
    }
}

Key Takeaways

  • Access tokens should be short-lived → reduces risk.

  • Refresh tokens should be secured in Keystore → prevents theft.

  • Automatic handling via Interceptor + Authenticator → reduces bugs.

  • Clean architecture separation → makes token logic testable + maintainable.

By following these best practices, you’ll deliver apps that are secure, reliable, and seamless for users.


Common Mistakes to Avoid

Even experienced developers sometimes fall into these pitfalls:

  1. Storing tokens in plain SharedPreferences

    • ❌ Vulnerable to root access and backup extraction.

    • ✅ Use Encrypted DataStore or Keystore.

  2. Using long-lived access tokens

    • ❌ If stolen, attackers can access APIs indefinitely.

    • ✅ Keep access tokens short-lived, rely on refresh tokens.

  3. Not handling 401 Unauthorized properly

    • ❌ App just crashes or shows an error.

    • ✅ Automatically refresh the token using Authenticator.

  4. Storing refresh tokens in memory only

    • ❌ Refresh token will be lost when the app restarts, forcing re-login.

    • ✅ Store refresh token securely on disk (Keystore-backed).

  5. Logging tokens in Crashlytics or Logcat

    • ❌ Attackers can retrieve sensitive tokens from logs.

    • ✅ Never log tokens, redact them if necessary.

  6. Not clearing tokens on logout

    • ❌ User data can remain exposed.

    • ✅ Always clear tokens from secure storage on logout.

  7. Refreshing tokens too eagerly

    • ❌ Wastes server resources and battery.

    • ✅ Refresh only when expired (lazy refresh).


 Token Lifecycle Management

  • On login → store both access + refresh token securely.

  • On every request → add access token.

  • On 401 → refresh token automatically.

  • On app start → check if refresh token exists & is valid.

  • On logout → clear all tokens from storage.




Final Words

Token management might sound like a low-level detail, but in reality, it’s the backbone of secure Android apps. Whether you’re building fintech, healthcare, or large-scale consumer apps, these practices ensure your app is both safe and user-friendly.


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป

Part 2: Hardware-Backed Encrypted DataStore in Android Security (with Example)

 Alright — let’s make Part 2 of this blog: a full hardware-backed Encrypted DataStore implementation for production use.

We’ll combine:

  • Jetpack DataStore (Preferences) for safe, async storage

  • Hardware-backed AES key in Android Keystore (StrongBox when available)

  • AES/GCM/NoPadding encryption with IV handling

  • Easy API for saving/reading/deleting sensitive strings



1. Why Combine Hardware-Backed Keys with DataStore?

From Part 1, we learned that hardware-backed encryption ensures that encryption keys never leave secure hardware and can’t be extracted.

DataStore is the modern alternative to SharedPreferences:

  • Asynchronous (no ANRs)

  • Type-safe

  • Corruption-handling

  • Flow-based API

By encrypting all values before storing them in DataStore — with a hardware-backed AES key — we get:

  • Encryption at rest + secure key storage

  • Resilience against root and file dump attacks

  • Modern, maintainable API


2. Dependencies

Add to your build.gradle:

dependencies {
    implementation "androidx.datastore:datastore-preferences:1.1.1"
}

No extra crypto libraries are needed — we’ll use Android’s built-in Keystore and javax.crypto.


3. Crypto Helper (Hardware-Backed)

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec
import android.util.Base64
import java.security.SecureRandom

object HardwareCrypto {
    private const val KEY_ALIAS = "app_secure_datastore_key"
    private const val ANDROID_KEYSTORE = "AndroidKeyStore"
    private const val TRANSFORMATION = "AES/GCM/NoPadding"
    private const val IV_SIZE_BYTES = 12
    private const val TAG_LENGTH_BITS = 128

    fun getOrCreateKey(): SecretKey {
        val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) }
        val existingKey = keyStore.getKey(KEY_ALIAS, null) as? SecretKey
        if (existingKey != null) return existingKey

        val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEYSTORE)
        val spec = KeyGenParameterSpec.Builder(
            KEY_ALIAS,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setKeySize(256)
            .setIsStrongBoxBacked(true) // Use StrongBox if available
            .build()

        keyGenerator.init(spec)
        return keyGenerator.generateKey()
    }

    fun encrypt(secretKey: SecretKey, plainText: String): String {
        val cipher = Cipher.getInstance(TRANSFORMATION)
        val iv = ByteArray(IV_SIZE_BYTES).also { SecureRandom().nextBytes(it) }
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, GCMParameterSpec(TAG_LENGTH_BITS, iv))
        val cipherBytes = cipher.doFinal(plainText.toByteArray(Charsets.UTF_8))
        return Base64.encodeToString(iv + cipherBytes, Base64.NO_WRAP)
    }

    fun decrypt(secretKey: SecretKey, encryptedBase64: String): String {
        val decoded = Base64.decode(encryptedBase64, Base64.NO_WRAP)
        val iv = decoded.copyOfRange(0, IV_SIZE_BYTES)
        val cipherBytes = decoded.copyOfRange(IV_SIZE_BYTES, decoded.size)
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.DECRYPT_MODE, secretKey, GCMParameterSpec(TAG_LENGTH_BITS, iv))
        return String(cipher.doFinal(cipherBytes), Charsets.UTF_8)
    }
}

4. Encrypted DataStore Manager

import android.content.Context
import androidx.datastore.preferences.core.edit
import androidx.datastore.preferences.core.preferencesKey
import androidx.datastore.preferences.preferencesDataStore
import kotlinx.coroutines.flow.Flow
import kotlinx.coroutines.flow.map
import javax.crypto.SecretKey

private val Context.secureDataStore by preferencesDataStore(name = "secure_prefs")

class EncryptedDataStoreManager(private val context: Context) {

    private val secretKey: SecretKey by lazy { HardwareCrypto.getOrCreateKey() }

    suspend fun saveString(key: String, value: String) {
        val encrypted = HardwareCrypto.encrypt(secretKey, value)
        context.secureDataStore.edit { prefs ->
            prefs[preferencesKey<String>(key)] = encrypted
        }
    }

    fun readString(key: String): Flow<String?> {
        return context.secureDataStore.data.map { prefs ->
            prefs[preferencesKey<String>(key)]?.let {
                try { HardwareCrypto.decrypt(secretKey, it) } catch (e: Exception) { null }
            }
        }
    }

    suspend fun removeKey(key: String) {
        context.secureDataStore.edit { prefs ->
            prefs.remove(preferencesKey<String>(key))
        }
    }

    suspend fun clearAll() {
        context.secureDataStore.edit { it.clear() }
    }
}

5. Example Usage

val secureStore = EncryptedDataStoreManager(context)

// Saving
lifecycleScope.launch {
    secureStore.saveString("auth_token", "super_secret_token_123")
}

// Reading
lifecycleScope.launch {
    secureStore.readString("auth_token").collect { token ->
        println("Decrypted token: $token")
    }
}

6. Benefits of This Approach

  • Hardware-backed keys protect encryption keys at the hardware level

  • Asynchronous DataStore prevents ANRs

  • AES-256 GCM provides confidentiality + integrity verification

  • StrongBox support ensures even higher security on compatible devices

  • Simple API for engineers to integrate


7. Final Thoughts

If your app handles any sensitive data — authentication tokens, API secrets, offline cached PII — you should never store it in plain text. Combining hardware-backed keys with modern DataStore gives you an end-to-end secure storage layer that’s:

  • Modern

  • Maintainable

  • Resistant to common mobile security threats

In a security audit, this design will be a strong point in your architecture.


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป

Part 1: Why Hardware-Backed Encryption Matters in Android Security (with Example)

When storing sensitive information in Android apps — such as authentication tokens, API keys, or personally identifiable information (PII) — it’s not enough to “just encrypt it.”

Where and how encryption keys are stored is as important as encrypting the data itself. If your encryption keys can be extracted from the device, your encryption is essentially useless.

That’s where hardware-backed encryption in Android comes into play.


2. What is Hardware-Backed Encryption?

Android devices often include a Trusted Execution Environment (TEE) or Secure Element (SE) — an isolated, secure chip separate from the main CPU.

When you generate encryption keys with the Android Keystore and request them to be hardware-backed, the keys:

  • Are generated inside secure hardware

  • Never leave the hardware in plaintext form

  • Are used directly for cryptographic operations inside the TEE/SE

If an attacker gains root access or dumps the device’s memory, the encryption key is still safe because it physically cannot be extracted.


3. Why It’s Important

Without hardware-backed encryption:

  • Keys are stored in software, protected only by file system permissions

  • A rooted device or sophisticated malware can steal them

With hardware-backed encryption:

  • Keys are tied to the device hardware

  • Even if your app's data is exfiltrated, the attacker cannot decrypt it without the physical device and access credentials

  • Optionally, you can require user authentication (PIN, password, or biometric) before the key can be used


Real-World Scenarios

  • Banking apps protecting stored session tokens

  • Healthcare apps storing patient records offline

  • Messaging apps protecting encryption keys for end-to-end chats

  • IoT control apps where device commands must be authenticated


4. How to Use Hardware-Backed Keystore in Android

Here’s how to generate and use a hardware-backed AES key in Android:

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec
import android.util.Base64

private const val KEY_ALIAS = "my_hardware_backed_key"
private const val TRANSFORMATION = "AES/GCM/NoPadding"

fun getOrCreateHardwareKey(): SecretKey {
    val keyStore = java.security.KeyStore.getInstance("AndroidKeyStore").apply { load(null) }

    val existingKey = keyStore.getKey(KEY_ALIAS, null) as? SecretKey
    if (existingKey != null) return existingKey

    val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore")
    val spec = KeyGenParameterSpec.Builder(
        KEY_ALIAS,
        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
    )
        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
        .setKeySize(256)
        .setIsStrongBoxBacked(true) // Use StrongBox if available
        .build()

    keyGenerator.init(spec)
    return keyGenerator.generateKey()
}

fun encryptData(secretKey: SecretKey, plainText: String): String {
    val cipher = Cipher.getInstance(TRANSFORMATION)
    cipher.init(Cipher.ENCRYPT_MODE, secretKey)
    val iv = cipher.iv
    val encryptedBytes = cipher.doFinal(plainText.toByteArray(Charsets.UTF_8))
    val combined = iv + encryptedBytes
    return Base64.encodeToString(combined, Base64.NO_WRAP)
}

fun decryptData(secretKey: SecretKey, encryptedBase64: String): String {
    val decoded = Base64.decode(encryptedBase64, Base64.NO_WRAP)
    val iv = decoded.copyOfRange(0, 12)
    val cipherData = decoded.copyOfRange(12, decoded.size)
    val cipher = Cipher.getInstance(TRANSFORMATION)
    cipher.init(Cipher.DECRYPT_MODE, secretKey, GCMParameterSpec(128, iv))
    return String(cipher.doFinal(cipherData), Charsets.UTF_8)
}

5. How This Works

  1. Key generation:

    • setIsStrongBoxBacked(true) attempts to store the key in the StrongBox secure hardware if the device supports it (Pixel devices, some Samsung models).

    • If StrongBox isn’t available, it falls back to TEE-backed storage.

  2. Key usage:

    • The AES key never leaves secure hardware.

    • Encryption/decryption operations happen inside the hardware security module.

  3. IV handling:

    • We prepend the IV to the ciphertext so it’s available during decryption.

    • The IV is not secret, but must be unique for each encryption.


6. Checking Hardware Support

You can verify if the key is hardware-backed:

val keyStore = java.security.KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
val key = keyStore.getKey(KEY_ALIAS, null)
val cert = keyStore.getCertificate(KEY_ALIAS)
val isHardwareBacked = cert.publicKey?.format == "X.509" // Basic check

println("Hardware-backed: $isHardwareBacked")

For detailed attestation, use KeyInfo from KeyFactory.getKeySpec(...) to check isInsideSecureHardware.


7. Best Practices

  • Always use hardware-backed keys for sensitive data if the device supports it.

  • Fail gracefully — if hardware-backed storage is unavailable, fall back to software-keystore encryption but with user notification or reduced functionality.

  • Use setUserAuthenticationRequired(true) for extra protection so that the user must authenticate before the key can be used.

  • Rotate keys periodically and securely delete old keys.

  • Never log plaintext or keys.


8. My thoughts

Using Android’s hardware-backed keystore isn’t just a “nice to have” — it’s a necessity for any app that deals with sensitive user data.

By ensuring your keys never leave secure hardware, you protect against a whole class of attacks that target extracted or leaked keys. For banking, fintech, healthcare, and enterprise apps, this can be the difference between a minor breach and a catastrophic data leak.


๐Ÿ’ก Next step: In a future article, I’ll show how to combine hardware-backed keys with Jetpack Encrypted DataStore so your stored data remains encrypted even if your app’s data directory is compromised.


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป

Version Control, Branch Management, and CI/CD in Android Development

In Android app development, effective version control, branch management, and CI/CD integration are vital for maintaining code quality, collaboration, and seamless releases. This blog article will provide a comprehensive guide for Android developers to efficiently manage their Android projects, from versioning to deployment.


1. Versioning Your Android App

Versioning your Android app is crucial to track changes over time, manage releases, and ensure backward compatibility. Android uses the versionCode and versionName in build.gradle to define the version of the app.

What is Versioning?

  • versionCode: A unique integer that represents the version of your app internally. It must be incremented with every release (new features, fixes, etc.).

  • versionName: A user-readable string that identifies the version of the app (e.g., 2.3.0, 1.0.1).

Example in build.gradle (Kotlin DSL)

android {
    defaultConfig {
        applicationId = "com.example.app"
        versionCode = 10 // Increment on every release
        versionName = "2.3.0" // User-visible version
    }
}

Versioning Best Practices:

  • Use Semantic Versioning: Follow the format MAJOR.MINOR.PATCH (e.g., 2.3.0).

  • Tag Versions in Git: Create a Git tag for every release (e.g., v2.3.0), so it's easy to track versions and rollback if needed.

git tag v2.3.0
git push origin v2.3.0

2. Product Flavors and Build Variants

In Android, product flavors allow you to build different versions of your app, tailored to various configurations, environments, or users. You can have distinct versions of your app for development, testing, production, or different customers (white-labeling).

Why Use Product Flavors?

  • Multiple configurations: Set different API endpoints, themes, or features for each flavor.

  • Easy differentiation: Build variants like devDebug, qaRelease, prodRelease, etc., to test and deploy different versions of the app.

Configuring Product Flavors in build.gradle

android {
    flavorDimensions += "environment"
    productFlavors {
        create("dev") {
            dimension = "environment"
            applicationIdSuffix = ".dev"
            versionNameSuffix = "-dev"
            buildConfigField("String", "BASE_URL", "\"https://dev.api.example.com\"")
        }
        create("qa") {
            dimension = "environment"
            applicationIdSuffix = ".qa"
            versionNameSuffix = "-qa"
            buildConfigField("String", "BASE_URL", "\"https://qa.api.example.com\"")
        }
        create("prod") {
            dimension = "environment"
            buildConfigField("String", "BASE_URL", "\"https://api.example.com\"")
        }
    }
}

Types of Build Variants:

  • devDebug: For local development with debug configurations.

  • qaRelease: For testing with QA configurations.

  • prodRelease: For the final production version of the app.

You can choose and build the desired flavor directly in Android Studio’s Build Variants panel.

3. Branch Management Strategy

Branch management is a fundamental practice for maintaining a clean and efficient codebase. It allows multiple developers to work simultaneously without overwriting each other’s changes.

Recommended Branching Model

Git Flow

The Git Flow model is widely used for managing feature development, releases, and hotfixes:

main        ← production-ready code
develop     ← current development version
feature/*   ← new features (e.g., feature/login-screen)
bugfix/*    ← minor fixes
hotfix/*    ← urgent production issues
release/*   ← staging for QA and final release
  • main branch: Always contains production-ready code.

  • develop branch: The latest development code that is stable.

  • feature/* branches: Used for individual features or tasks.

  • release/* branches: A preparation for final testing and deployment.

  • hotfix/* branches: Used for critical issues in production.

Best Practices for Branch Management:

  • Start with develop: Create a feature branch from develop for new features.

git checkout develop
git checkout -b feature/onboarding-screen
  • Commit frequently: Make small, incremental commits with meaningful messages.

  • Pull regularly: Keep your branch up-to-date with develop by pulling changes frequently.

git fetch origin
git rebase origin/develop
  • Merge via PRs: Always merge feature branches through a Pull Request (PR) to ensure code quality via code reviews.

Git Commands for Branch Management:

# Create a feature branch
git checkout -b feature/login-screen

# Commit changes
git add .
git commit -m "Added login screen UI"

# Push changes
git push origin feature/login-screen

# Merge into develop
git checkout develop
git merge feature/login-screen

4. CI/CD and Git Integration

Continuous Integration (CI) and Continuous Deployment (CD) are crucial for automating the build, test, and deployment process. In Android development, CI/CD ensures that your app is always in a deployable state and that tests are run consistently.

CI/CD Workflow with GitHub Actions

A simple GitHub Actions workflow might look like this:

name: Android CI

on:
  push:
    branches: [ develop, release/* ]
  pull_request:
    branches: [ develop ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Build devDebug
        run: ./gradlew assembleDevDebug

      - name: Run tests
        run: ./gradlew testDevDebugUnitTest

CI/CD Best Practices:

  • Automate Builds: Trigger builds automatically on PRs and pushes to develop or release/*.

  • Run Unit/UI Tests: Ensure every commit and PR runs unit tests (JUnit, Espresso) and static code checks (ktlint, detekt).

  • Build APK/AAB: Use assembleRelease or bundleRelease to build your app for distribution.


5. Release & Distribution

Once your app is ready for production, it's time to distribute it to users. You can either publish it to the Google Play Store or distribute it to a group of testers via Firebase App Distribution.

Release to Google Play Store:

  • Signing: Use a signed APK or AAB.

  • Versioning: Ensure versionCode is incremented.

  • Use Fastlane for Automation:

    • Automate screenshots, changelogs, and upload to the Play Store.

fastlane android beta

Firebase App Distribution:

Firebase App Distribution is great for distributing pre-release versions to testers.

firebase appdistribution:distribute app-release.apk \
  --app <APP_ID> \
  --groups "qa-team"

Challenges and Solutions
  • Challenge: Managing multiple build variants (e.g., for different countries or environments). Solution: Use Gradle flavors (e.g., country1Debug, country2Release) and automate variant selection in the pipeline.
  • Challenge: Slow build times. Solution: Cache dependencies and parallelize test execution.
  • Challenge: App store approval delays. Solution: Use continuous delivery to deploy to beta channels for early feedback, reserving continuous deployment for internal environments.

My thoughts

Managing versioning, flavors, branches, and CI/CD in Android development is crucial to ensure smooth, scalable, and maintainable app development. By adopting a structured approach to versioning, branching, and automation, you can streamline development, reduce errors, and improve the release process.

With the strategies outlined above, your Android development workflow will be efficient, collaborative, and optimized for both feature development and rapid deployment.


๐Ÿ“ข Feedback: Did you find this article helpful? Let me know your thoughts or suggestions for improvements! Please leave a comment below. I’d love to hear from you! ๐Ÿ‘‡

Happy coding! ๐Ÿ’ป