GlomoPay Android SDK v1

Official Android SDK for integrating GlomoPay payment checkout flows into your native Android applications.

Full Changelog is also available.

Before using this SDK, you need:

• API credentials (Public Key) from your GlomoPay dashboard
• An order ID created via the GlomoPay API (or a subscription ID for subscription payments)

The SDK is published to Maven Central.

Gradle (Kotlin DSL):

dependencies {
    implementation("com.glomopay:glomo-android-sdk:1.0.0")
}

Gradle (Groovy DSL):

dependencies {
    implementation 'com.glomopay:glomo-android-sdk:1.0.0'
}

import android.app.Activity
import android.util.Log
import com.glomopay.sdk.android.*

class CheckoutActivity : Activity(), GlomoPayListener {

    fun startPayment() {
        val config = GlomoPayConfig(
            publicKey = "live_your_public_key",
            orderId = "order_your_order_id",
        )
        GlomoPaySdk.startCheckout(this, config, this)
    }

    override fun onPaymentSuccess(payload: GlomoPayPayload) {
        // Verify signature server-side before fulfilling the order
        val orderId = payload.orderId
        val paymentId = payload.paymentId
        val signature = payload.signature
    }

    override fun onPaymentFailure(payload: GlomoPayPayload) {
        // Handle payment failure
    }

    override fun onSdkError(errors: List<SdkError>) {
        // Handle validation or device compliance errors
        errors.forEach { error ->
            Log.e("GlomoPay", "${error.type}: ${error.message}")
        }
    }

    override fun onConnectionError(error: ConnectionError) {
        // Handle network / WebView errors
        if (error.isRecoverable) {
            // Retry or show retry UI
        }
    }

    override fun onPaymentTerminate(source: TerminationSource) {
        // User dismissed checkout
    }

    override fun onEvent(name: String, payload: Map<String, Any?>) {
        // Diagnostic / analytics events (optional)
    }
}

The SDK's AndroidManifest.xml declares INTERNET, ACCESS_NETWORK_STATE, and the checkout activity automatically. These merge into your app's manifest — no additional manifest configuration is required.

To process subscription payments, pass a subscriptionId instead of an orderId:

val config = GlomoPayConfig(
    publicKey = "live_your_public_key",
    subscriptionId = "sub_your_subscription_id",
)
GlomoPaySdk.startCheckout(this, config, this)

When subscriptionId is provided:

• The SDK skips order type detection
• The subscriptionId must start with sub_
• Do not pass both orderId and subscriptionId - the SDK will fire onSdkError

• Standard, LRS, and Subscriptions checkout flows
• Automatic order type detection based on API response
• WebView-based secure checkout - payment data never passes through merchant code
• Payment callbacks with signature verification
• Device security compliance - root and debugger detection for live keys
• Mock mode for testing with test_ and mock_ key prefixes
• Connection error handling with recovery hints (isRecoverable)
• File upload support via system document picker
• ProGuard/R8 compatible - consumer rules included automatically

object GlomoPaySdk {
    fun startCheckout(
        context: Context,
        config: GlomoPayConfig,
        listener: GlomoPayListener,
        orderType: String = "auto"
    )
}

Exactly one of orderId or subscriptionId must be provided. If both or neither are set, onSdkError fires.

data class GlomoPayPayload(
    val orderId: String,
    val paymentId: String? = null,
    val signature: String? = null,
)

Merchant responsibility: Always verify the signature on your server using your secret key before fulfilling an order. See Checkout overview for verification instructions.

enum class SdkErrorType {
    VALIDATION_ERROR,
    DEVICE_FORBIDDEN,
    NETWORK_ERROR,
    UNKNOWN,
}

data class SdkError(
    val type: SdkErrorType,
    val message: String,
    val field: String? = null,
)

enum class ConnectionErrorType {
    NO_INTERNET,
    DNS_FAILURE,
    TIMEOUT,
    SSL_ERROR,
    HTTP_CLIENT_ERROR,
    HTTP_SERVER_ERROR,
    WEB_RESOURCE_ERROR,
    UNKNOWN,
}

data class ConnectionError(
    val type: ConnectionErrorType,
    val message: String,
    val statusCode: Int? = null,
    val failedUrl: String? = null,
    val isRecoverable: Boolean,
)

enum class TerminationSource {
    USER_DISMISS,
    BACK_BUTTON,
    PROGRAMMATIC,
    CONNECTION_ERROR,
}

• Checkout launches as a new Activity (fullscreen, portrait)
• Back button dismisses the checkout and fires onPaymentTerminate(BACK_BUTTON)
• Close button fires onPaymentTerminate(USER_DISMISS)
• The checkout Activity is declared in the SDK's manifest and merges automatically — merchants do not need to declare it

• Exactly one of orderId or subscriptionId must be provided.
• Validation errors fire onSdkError with VALIDATION_ERROR and the field that failed.

The SDK includes consumer ProGuard rules that are applied automatically. Merchants do not need to add any ProGuard configuration. R8 full mode is safe.

Check that publicKey format is valid and exactly one of orderId/subscriptionId is provided.

Use a test_ or mock_ key prefix during development.

Check network connectivity. Verify the order exists and is in a valid state.

Ensure the device's system time is correct. Check for corporate proxy or certificate pinning issues.

• Payment data is handled within a secure, isolated WebView — it never passes through the merchant's application code
• JavaScript bridge communication is limited to payment lifecycle events; no PAN, CVV, or sensitive payment data crosses the bridge
• Root and debugger detection blocks checkout on compromised devices (live keys only)
• File access is disabled in the WebView; only content:// URIs from the system document picker are allowed

To report a security vulnerability, email security@glomopay.com. Do not open a public GitHub issue for security reports.

• Changelog - all release notes
• React Native SDK - GlomoPay SDK for React Native apps
• Flutter SDK - GlomoPay SDK for Flutter apps
• Unified SDK (Web) - GlomoPay SDK for web apps
• Checkout overview - server-side checkout integration and signature verification