AB#268288 Federated Authentication by graciecooper · Pull Request #87 · optimove-tech/Optimove-SDK-Android

graciecooper · 2026-03-25T16:10:59Z

Description of Changes

Adds Federated JWT authentication to the Android SDK. When OptimoveConfig.Builder.enableAuth(AuthTokenProvider) is used, the SDK asks the app for a JWT per user context and attaches it as X-User-JWT on user-identified outbound traffic (anonymous / install-scoped traffic omits the JWT where applicable).

Key changes

AuthManager + enableAuth(AuthTokenProvider) on OptimoveConfig.Builder
X-Optimove-Auth-Capable: 1 on SDK HTTP traffic (HttpClient + OptimobileHttpClient)
JWT for user-identified calls: Optistream (OptiTrack), Realtime, Preference Center, Embedded Messaging, Optimobile analytics, in-app (inbox fetch)
OptistreamHandler groups batches by customer so each request has one JWT
Optimobile analytics pulls the next queue slice per userIdentifier so the JWT matches the batch
Token failures: Optistream / Realtime skip sending that attempt; blocking-JWT Optimobile paths may still send without X-User-JWT

Usage

Kotlin

OptimoveConfig.Builder(/* … */)
    .enableAuth { userId, callback ->
        MyAuthService.getJwt(userId) { jwt, error ->
            callback.onComplete(jwt, error)
        }
    }
    // …
    .build()

Breaking Changes

None

Release Checklist

Prepare:

Detail any breaking changes. Breaking changes require a new major version number, and a migration guide in wiki / README.md

Bump versions in:

CHANGELOG.md
gradle.properties
add links to newly created wiki pages to readme
Update major version numbers in wiki (basic integration + push guides)

Integration tests

T&T Only

Init SDK with only optimove credentials
Associate customer
Associate email
Track events

Mobile Only

Deferred Deep Links

With app installed, trigger deep link handler
With app uninstalled, follow deep link, install test bundle, verify deep link read from Clipboard, trigger deep link handler

Combined

Track event for T&T, verify push received
Trigger scheduled campaign, verify push received
Trigger scheduled campaign, verify In-App received

Release Procedure

Squash and merge dev to master
Delete branch once merged

k-antipochkin · 2026-04-16T14:19:51Z

+        this(httpClient, realtimeConfigs, context, null);
+    }
+
+    public RealtimeManager(@NonNull HttpClient httpClient, @NonNull RealtimeConfigs realtimeConfigs,


Do we need this additional constructor? shouldnt we just have one and mock the auth in tests? (We should add tests to RT in any case)

k-antipochkin · 2026-04-16T14:25:28Z

                }
-                result = super.postSync(url, postBody, true);
+                String jwt = super.resolveJwt(this.customerId);
+                if (AuthJwtResolver.isMissingRequiredJwt(Optimove.getConfig().getAuthTokenProvider(), this.customerId, jwt)) {


See line 99, could this cause all visitors to start failing requests? (userId is either userId or visitor here)

k-antipochkin · 2026-04-16T14:26:38Z

        }

+        public RequestBuilder<T> userJwt(@Nullable String jwt) {
+            return this;


Are we intentionally dropping this?

k-antipochkin · 2026-04-17T02:01:32Z

+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+public final class AuthManager {


Ideally we would want to inject it to all components that need it.

It is now possible in OptistreamHandler and RT.
It isnt possible with the singleton/static components.

We have 3 options:

Leave it like it is now - 5 instantiations with Optimove.getConfig().getAuthTokenProvider()

Inject where DI pattern is used (OptistreamHandler and RT) and use Optimove.getAuthManager() for the singletons instead

Use Optimove.getAuthManager() for all

I think 2 is cleanest (sooner or later we would need to stop letting random components seek the values they need in other singletons and get them using DI instead). 3 is pragmatic IMO. Let me know what you think.

k-antipochkin · 2026-04-17T02:12:25Z

@graciecooper Can we add some more test coverage for the auth flows (Embedded, grouping etc) or that would require significant refactoring?

k-antipochkin · 2026-04-17T16:05:32Z

+                                    error != null ? error.getMessage() : "null token");
+                            dispatchRequestWaitsForResponse = false;
+                            scheduleTheNextDispatch();
+                            return;


Should we abort all the remaining groups if one fails?

k-antipochkin · 2026-04-17T16:07:08Z

+
+        Runnable postOnExecutor = () -> postGroupJson(group, groups, index, null);
+
+        if (authManager != null && !customerKey.isEmpty()) {


Can we reduce the indentation here?

if (authManager == null || customerIsEmpty) { postOnExecutor.run(); return; }

// rest of auth

k-antipochkin · 2026-04-17T16:31:35Z

@graciecooper Is it possible to introduce a single dispatcher layer for RT and optistream like we did in iOS? or it would require a big refactoring?

k-antipochkin · 2026-04-17T16:36:00Z

+- Added Federated JWT authentication; OptimoveConfig.Builder.enableAuth(AuthTokenProvider) supplies tokens; the SDK adds X-User-JWT for user-identified Optistream, realtime, Preference Center, Embedded Messaging, Optimobile analytics, and in-app network calls.
+- Added Auth-capable signaling; Outbound SDK requests sent through HttpClient and OptimobileHttpClient include X-Optimove-Auth-Capable: 1 so backends can detect JWT-capable SDK versions.
+- Optistream and realtime paths now group events by customer identity so each request can carry a single JWT. Optimobile analytics drains queued events per stored user id (install/visitor-scoped batches do not attach a user JWT).
+


k-antipochkin · 2026-04-17T16:37:55Z

+        Map<String, List<OptistreamEvent>> map = new LinkedHashMap<>();
+        for (OptistreamEvent ev : events) {
+            String key = userKey(ev);
+            map.computeIfAbsent(key, k -> new ArrayList<>()).add(ev);


Does it require API 24? I think our minimum is 21?

k-antipochkin · 2026-04-17T16:40:16Z

+                }
+                httpClient.postJson(realtimeConfigs.getRealtimeGateway(), realtimeGson.toJson(group))
+                        .userJwt(token)
+                        .successListener(jsonResponse -> dispatchGroupAtIndex(groups, index + 1, allForFailure))


Should it be allForFailure or just the one group?

k-antipochkin · 2026-04-17T16:42:53Z

+    }
+
+    @Nullable
+    public static String blockingJwt(@Nullable AuthManager authManager, @Nullable String userId, long timeoutMs) {


In case of failures, should we log?

Squash Commits

db27d29

graciecooper force-pushed the feature/268288-federated-auth branch from 7e18f19 to db27d29 Compare April 2, 2026 11:16

Bump versions and update changelog

5387500

graciecooper marked this pull request as ready for review April 2, 2026 11:46

graciecooper added 3 commits April 2, 2026 13:20

Restore MainScreen.kt and MainActivity.kt

41a7b63

prevent requests on jwt fetch failure

49348cc

Merge branch 'master' into feature/268288-federated-auth

fb35058

k-antipochkin reviewed Apr 16, 2026

View reviewed changes

k-antipochkin reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AB#268288 Federated Authentication#87

AB#268288 Federated Authentication#87
graciecooper wants to merge 5 commits intomasterfrom
feature/268288-federated-auth

graciecooper commented Mar 25, 2026 •

edited

Loading

Uh oh!

k-antipochkin Apr 16, 2026

Uh oh!

k-antipochkin Apr 16, 2026

Uh oh!

k-antipochkin Apr 16, 2026

Uh oh!

k-antipochkin Apr 17, 2026 •

edited

Loading

Uh oh!

k-antipochkin commented Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

k-antipochkin commented Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

k-antipochkin Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		Runnable postOnExecutor = () -> postGroupJson(group, groups, index, null);

		if (authManager != null && !customerKey.isEmpty()) {

Conversation

graciecooper commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of Changes

Key changes

Usage

Breaking Changes

Release Checklist

Integration tests

Release Procedure

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-antipochkin Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-antipochkin commented Apr 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-antipochkin commented Apr 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

graciecooper commented Mar 25, 2026 •

edited

Loading

k-antipochkin Apr 17, 2026 •

edited

Loading