CallingAppInfo

public final lateinit @NonNull SigningInfo signingInfo

the signingInfo associated with the calling app, added at API level 28

@VisibleForTesting
@DeprecatedSinceApi(api = 28, message = "Use the SigningInfo based constructor instead")
public CallingAppInfo(
    @NonNull String packageName,
    @NonNull List<@NonNull Signature> signatures,
    String origin
)

Constructs an instance of CallingAppInfo

@RequiresApi(value = 28)
@VisibleForTesting
public CallingAppInfo(
    @NonNull String packageName,
    @NonNull SigningInfo signingInfo,
    String origin
)

Constructs an instance of CallingAppInfo

public final String getOrigin(@NonNull String privilegedAllowlist)

Returns the origin of the calling app. This is only non-null if a privileged app like a browser calls Credential Manager APIs on behalf of another application.

Additionally, in order to get the origin, the credential provider must provide an allowlist of privileged browsers/apps that it trusts. This allowlist must be in the form of a valid, non-empty JSON. The origin will only be returned if the packageName and the SHA256 hash of the newest signature obtained from the signingInfo, is present in the privilegedAllowlist.

Packages that are signed with multiple signers will only receive the origin if all of the signatures are present in the privilegedAllowlist.

The format of this privilegedAllowlist JSON must adhere to the following sample.

{"apps": [
   {
      "type": "android",
      "info": {
         "package_name": "com.example.myapp",
         "signatures" : [
         {"build": "release",
             "cert_fingerprint_sha256": "59:0D:2D:7B:33:6A:BD:FB:54:CD:3D:8B:36:8C:5C:3A:
             7D:22:67:5A:9A:85:9A:6A:65:47:FD:4C:8A:7C:30:32"
         },
         {"build": "userdebug",
         "cert_fingerprint_sha256": "59:0D:2D:7B:33:6A:BD:FB:54:CD:3D:8B:36:8C:5C:3A:7D:
         22:67:5A:9A:85:9A:6A:65:47:FD:4C:8A:7C:30:32"
         }]
      }
    }
]}

All keys in the JSON must be exactly as stated in the sample above. Note that if the build for a given fingerprint is specified as 'userdebug', that fingerprint will only be considered if the device is on a 'userdebug' build, as determined by Build.TYPE.

public final @NonNull String getPackageName()

the calling package name of the calling app

@RequiresApi(value = 28)
public final @NonNull SigningInfo getSigningInfo()

the signingInfo associated with the calling app, added at API level 28

public final @NonNull SigningInfoCompat getSigningInfoCompat()

the signing information associated with the calling app, which can be used across all Android API levels

public final boolean isOriginPopulated()

Returns true if the origin is populated, and false otherwise.

Note that the origin is only populated if a privileged app like a browser calls Credential Manager APIs on behalf of another application.