Android SDK Release Notes

Version 5.52.0 - 2026-August-20

API Changes (refer to Migration Guide for details)

• Status gains UNSUPPORTED and COULD_NOT_COMPLETE values. DeviceStats.motionStatus does not emit them. Please see Migration Guide for details if you do an exhaustive when over Status.

Added (ALL modes)

• Added OnboardingListener.onInterrupted() so integrators are notified when Android tears down the SDK Activity stack externally (not via SDK completion, cancel, or close). The callback defaults to a no-op, so existing subclasses need no changes.
• Improved SelfieScan and IdScan V2 analytics.

Added (STANDARD mode only)

• Dynamic Forms questions configured with a prefill source in the dashboard are now automatically populated from the user's ID Capture/OCR data before the form is shown.
• Added the final Namirial Review and sign screen with two plain consent checkboxes and a scrollable certificate application form. The Sign button becomes available after both consents are selected.

Fixed (ALL modes)

• Fixed a duplicate close (X) button appearing on the Combined Consent screen when the close button is enabled.
• Fixed main-thread ANR risk during Sentry re-initialization, clearLocalData(), audio recording start/stop retries, and Camera1 open. Those operations now run off the calling thread so the UI stays responsive.
• Security improvements.
• Fixed the published API reference (Javadoc) rendering <Error class: unknown class> instead of type names, and some member links that went nowhere. Type names and links are now correct.

Fixed (STANDARD and Submit-Only modes)

• Fixed captures (including face authentication) being rejected with HTTP 400 Invalid argument on devices whose clock was set incorrectly. An incorrect device clock no longer triggers this rejection.

Fixed (STANDARD mode only)

• Fixed Dynamic Forms country answers being sent and reported as ISO 3166-1 alpha-2 codes (for example, "RS"). Country answers are now sent and reported as alpha-3 (for example, "SRB"), which the dashboard resolves to a country name.

Module Versions

• nfc 1.5.9

Version 5.51.0 - 2026-Aug-05

Added dependencies

• androidx.camera:camera-camera2-pipe:1.6.1
• androidx.camera.viewfinder:viewfinder-core:1.5.1 (viewfinder is a separate androidx artifact with its own version line; 1.5.1 is the version CameraX 1.6.1 resolves)

Updated dependencies

• androidx.camera:camera-camera2:1.5.1 -> androidx.camera:camera-camera2:1.6.1
• androidx.camera:camera-core:1.5.1 -> androidx.camera:camera-core:1.6.1
• androidx.camera:camera-extensions:1.5.1 -> androidx.camera:camera-extensions:1.6.1
• androidx.camera:camera-lifecycle:1.5.1 -> androidx.camera:camera-lifecycle:1.6.1
• androidx.camera:camera-video:1.5.1 -> androidx.camera:camera-video:1.6.1
• androidx.camera:camera-view:1.5.1 -> androidx.camera:camera-view:1.6.1
• androidx.camera.featurecombinationquery:featurecombinationquery:1.5.1 -> androidx.camera.featurecombinationquery:featurecombinationquery:1.6.1
• androidx.compose.material3:material3:1.3.2 -> androidx.compose.material3:material3:1.4.0
• androidx.compose.ui:ui:1.7.8 -> androidx.compose.ui:ui:1.8.2
• androidx.compose.ui:ui-graphics:1.7.8 -> androidx.compose.ui:ui-graphics:1.8.2
• androidx.lifecycle:lifecycle-process:2.6.2 -> androidx.lifecycle:lifecycle-process:2.9.0
• androidx.lifecycle:lifecycle-runtime-compose:2.7.0 -> androidx.lifecycle:lifecycle-runtime-compose:2.9.0
• androidx.lifecycle:lifecycle-runtime-ktx:2.6.2 -> androidx.lifecycle:lifecycle-runtime-ktx:2.9.0
• androidx.lifecycle:lifecycle-viewmodel-ktx:2.6.2 -> androidx.lifecycle:lifecycle-viewmodel-ktx:2.9.0
• androidx.room:room-compiler:2.6.1 -> androidx.room:room-compiler:2.8.4
• androidx.room:room-rxjava2:2.6.1 -> androidx.room:room-rxjava2:2.8.4
• androidx.room:room-runtime:2.6.1 -> androidx.room:room-runtime:2.8.4
• com.google.devtools.ksp:symbol-processing-api:1.9.25-1.0.20 -> com.google.devtools.ksp:symbol-processing-api:2.2.21-2.0.5
• com.squareup.okhttp3:logging-interceptor:4.12.0 -> com.squareup.okhttp3:logging-interceptor:5.3.2
• com.squareup.okhttp3:okhttp:4.12.0 -> com.squareup.okhttp3:okhttp:5.3.2
• org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.25 -> org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.2.21. Any module compiling Kotlin source with the SDK on its classpath now requires Kotlin 2.2.x or newer; see the Migration Guide.
• org.jetbrains.kotlinx:kotlinx-serialization-json:1.5.0 -> org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3

Build requirements

• compileSdk must be 36 or higher when embedding this SDK version.
• The Kotlin Gradle plugin must be 2.2.x (2.2.21 or newer). The SDK is compiled with Kotlin 2.2.21, so apps on an older Kotlin compiler may fail to compile against it with a Kotlin metadata-incompatibility error.
• Android Gradle Plugin (AGP) 8.9.1 or higher is required (needed for compileSdk 36).
• Gradle 8.14.5 or higher is required (needed by AGP 8.9.1).
• kotlinx-coroutines 1.9.0 or higher is now required. CameraX 1.6.1 pulls this version in transitively, so no manual declaration is needed, but your project's coroutines version must be at least 1.9.0.

API Changes (refer to Migration Guide for details)

• The QES constructor is no longer public; construct the module via QES.Builder. See Migration Guide for details.

Added (STANDARD mode only)

• Added the QES (Qualified Electronic Signature) V2 module with the new Compose UI, including an optional document-upload screen and an in-app document viewer with pinch-to-zoom. Available when the V2 feature gate is enabled.
• Added QES.Builder.setUploadDocument(...) and QES.Builder.setProviderCode(...) to show a document-upload screen before signing and to select the qualified signature provider for the session.
• Added a Review & Sign experience in the QES module that displays provider-specific terms and consents for the user to review and accept.

Fixed (ALL modes)

• Sped up IdScan and SelfieScan by removing the internal frame-rate limit, so the camera now analyzes frames as fast as the device allows for a quicker, smoother capture.
• Security improvements.
• Connectivity checks now use NetworkCapabilities instead of the deprecated getActiveNetworkInfo() API, so VPN connections are correctly treated as online.
• SDK error logs now always include the full error cause, making reported issues easier to diagnose from device logs.
• Fixed androidx.compose.* runtime crashes on Compose (V2) screens. The SDK now requires Compose Material3 1.4.0 and Compose 1.8.0 or newer. Please refer to the Migration Guide for details.
• Fixed a crash (NoClassDefFoundError: okhttp3.internal.Util) when an integrating app resolved OkHttp/logging-interceptor to a 5.x version different from the SDK's compiled dependency. The SDK's OkHttp and logging-interceptor dependency is now 5.3.2, so integrators pinning OkHttp to 5.x no longer conflict with the SDK's classpath.
• The SDK's internal storage migration could delete a Keystore master key alias shared with the host app's own EncryptedSharedPreferences, leaving unrelated host app data permanently undecryptable (AEADBadTagException) after upgrade. The migration no longer touches that shared key.
• Fixed authentication device data not syncing to the Dashboard, which caused NA values or missing records. Updating to this version restores syncing.
• Fixed a first-launch race in the SDK's encrypted-database initialization that could permanently corrupt a local database, causing a host-app crash (OnErrorNotImplementedException, file is not a database) on every later launch, most visibly when opening the selfie camera in Login flows. Affected devices now recover automatically on the next launch: the corrupted database is deleted and recreated. Locally enrolled face templates and unsynced face-login attempts stored in that database are lost, so affected users must re-enroll for local face login.

Changed (non-CAPTURE_ONLY modes)

• Minimized the data collected and sent when on-device face processing (SelfieScan.Builder.setOnDeviceFaceResultsSubmissionEnabled(true)) is enabled, in line with the privacy-centric intent of on-device flows.

Removals

• Removed the deviceStats field from BaseResult, so it is no longer present on the Result classes that never carried it (for example FaceMatchResult, VideoSelfieResult, EKYCResult). deviceStats remains available on IdScanResult and SelfieScanResult. Please refer to the Migration Guide for details.

Module Versions

• core-light 3.0.16
• nfc 1.5.8

Version 5.50.0 - 2026-July-22

API Changes (refer to Migration Guide for details)

• SelfieScan.Builder.setVideoLivenessRecordingEnabled(Boolean) is deprecated. Use SelfieScan.Builder.setDeepsightConfiguration(...) instead.
• IdScan primary constructor gains motionEnabled: Boolean = false. Kotlin source callers are unaffected; Java callers using the primary constructor directly must recompile. IdScan.Builder callers are unaffected. Please see Migration Guide for details.

Added (ALL modes)

• Added NFC Scan V2 module. Available when the V2 feature gate is enabled.
• Added a typed date input with a calendar picker to V2 form date fields.
• Added SelfieScan.Builder.setDeepsightConfiguration(...) and FaceAuthentication.Builder.setDeepsightConfiguration(...) to configure the Deepsight liveness modality (DeepsightConfiguration.Modality.SINGLE_FRAME, DeepsightConfiguration.Modality.MULTIMODAL, or DeepsightConfiguration.Modality.VIDEO_LIVENESS) and motion collection, matching the three options available in the Dashboard.
• Added DeepsightConfiguration.Builder.setEnabled(Boolean) to enable or disable Deepsight liveness independently from motion collection. When false, liveness modality selection is skipped while motionEnabled still applies. Defaults to true.
• Added IdScan.Builder.setMotionEnabled(Boolean) to enable motion data collection during ID scan in SdkMode.CAPTURE_ONLY. In STANDARD, FLOW, and WORKFLOW modes the server-side configuration takes precedence. Defaults to false.

Added (STANDARD, Submit-Only, and Delayed modes)

• Added SDK Diagnostics collection. Enabled by default; opt out with IncodeWelcome.Builder(this, WELCOME_API_URL, WELCOME_API_KEY).setDiagnosticsDataEnabled(false). Diagnostics are collected and uploaded for the standard onboarding flows (startOnboarding, startFlow, startWorkflow) in STANDARD, SUBMIT_ONLY, and DELAYED modes. startOnboardingSection() and SdkMode.CAPTURE_ONLY are not supported yet.

Added (STANDARD and Submit-Only modes)

• Added IdScan.Builder.setExtractIdFace(...) to let integrations skip backend ID-face extraction for regulated-region sessions. Default remains true; when set to false, the SDK sends extractIdFace=false on front-ID uploads, including submit-only encrypted uploads, and downstream face-match is unavailable for that session.

Added (STANDARD mode only)

• Added Silent Network Authentication (SNA) as an alternative to SMS OTP in the Phone V2 module, enabled exclusively through the flow configuration (the snaVerification setting in the Dashboard) - there is no client-side API to turn it on. Uncovered numbers, transient failures, and devices below API 24 fall back to SMS OTP automatically. See the SNA guide for supported entry points, bundled permissions, the optional READ_PHONE_STATE 2G safeguard, and licensing notes.

Fixed (ALL modes)

• Selfie Scan and Face Authentication capture metadata now reports the Deepsight motion flag even when liveness is off, so the backend can validate it against the flow configuration (matching iOS and ID capture).
• Fixed a crash when calling deviceStats.getMotionStatus() from any module result listener.
• Fixed an encrypted-preferences race that could transiently drop a just-written value (such as the session token), occasionally causing authenticated requests to fail.
• Added the IdInfo (OCR review) V2 module with the new Compose UI, including a processing screen, a success screen, and a submit-error screen with retry. Available when the V2 feature gate is enabled.
• Fixed an issue where server-side Face Login authentication via startFaceLogin() would allow a blocklisted user to log in. The SDK now denies the login (FaceLoginResult.success is false) on server-side 1:1 and 1:N face authentication, and a new SelfieScanResult.isBlocklisted flag is set whenever the backend reports the recognized user as blocklisted.
• Updated Javadocs for SelfieScan.Builder.
• Fixed an SDK-init ANR where IncodeWelcome.Builder.build() could block the calling thread for multiple seconds on a cold start, causing Input dispatching timed out when called synchronously during Activity creation. build() now returns promptly regardless of calling thread; database and key setup complete in the background.
• Fixed the NFC Scan module ending the flow with an error when it ran as the first module with no prior ID data. The OCR review screen now opens so the user can enter the data manually.
• Fixed the NFC Scan module showing the ID type chooser at the wrong step when idType was not pre-selected. The chooser now appears before OCR so the user can pick the document type first.

Fixed (STANDARD mode only)

• Fixed SelfieScan V2 so a detected spoof is surfaced on SelfieScanResult: isSpoofAttempt is now populated (true/false) and status reports STATUS_SPOOF_DETECTED instead of STATUS_GENERIC_ERROR, matching V1 and the documented contract.
• Fixed Selfie Scan and Face Authentication getting stuck on the processing screen with no selfie uploaded when the video-liveness recording could not be produced or uploaded (e.g. the camera was invalidated mid-recording). The selfie is now submitted without the recording.
• Fixed an issue where startOnboarding() and startOnboardingSection() executed the wrong Deepsight liveness mode when a flow was configured with both selfie and face authentication modules.
• Fixed VideoSelfie uploads that could time out and leave the video missing on the dashboard. The SDK now retries failed uploads with backoff and surfaces a terminal error after exhausting retries instead of silently dropping the file.

Fixed (STANDARD, Submit-Only, and Delayed modes)

• Fixed SDK Diagnostics (TrueSight) uploads being dropped after the session token was cleared (for example after deleteUserLocalData() or consent denial). Diagnostics now retain buffered entries across tokenless flushes and upload them on the next authenticated flush.

Fixed (Capture-Only mode)

• Fixed IdScan.Builder.setMotionEnabled(true) being ignored in Capture-Only mode, causing the capture metadata to always report motion as disabled regardless of the client-side setting.

Changed (non-CAPTURE_ONLY modes)

• SelfieScan.Builder.setDeepsightConfiguration(...) is now only applied in SdkMode.CAPTURE_ONLY. In all other modes (STANDARD, SUBMIT_ONLY, DELAYED) the server/flow configuration takes precedence and any code-side DeepsightConfiguration is ignored (a warning is logged).

Deprecations (ALL modes)

• SelfieScan.Builder.setVideoLivenessRecordingEnabled(Boolean) is deprecated in favor of SelfieScan.Builder.setDeepsightConfiguration(...).

Documentation

• Reorganized the SDK Customization Guide: V2 customization is now documented first, fully separated from the legacy V1 sections, and each generation now has its own logo and animations customization sections.
• Updated the Google Wallet ID Setup And Testing Guide for SDK 5.50.0 availability, the googleWallet flow field, and direct invocation.

Added dependencies

• com.idlayr:idlayr-sdk-android:2.4.0 (vendored inside onboard.aar; integrators do not add this themselves - see Licenses)

Module Versions

• core-light 3.0.15
• nfc 1.5.7

Version 5.49.0 - 2026-June-16

API Changes (refer to Migration Guide for details)

• Removed IncodeWelcome.getReport(interviewId, ReportListener), the ReportListener interface, and the ResponseEventReport class. The backing /omni/get/report backend endpoint is no longer supported and reports cannot be generated through the SDK. Please refer to the Migration Guide for details.
• Renamed IncodeColorPalette.neutral to neutralLight and IncodeColorPalette.black to neutralDark, including the matching JSON keys, to align with iOS so a single theme JSON works across both platforms.

Added (ALL modes)

• Updated core-light module to v3.0.14: incorporating libRecogKitAndroid.so v3.9.2; fixing a regression (introduced in 5.42.0) that slowed on-device ML model loading and increased SDK initialization time.
• Added missing Javadocs for SelfieScanResult fields and STATUS_* constants, including @since links to the introducing or deprecating SDK versions where available.
• Added consecutive-frame debouncing for blur and glare real-time feedback in the IdScan module so a single bad frame no longer flashes the error pill. Aligns Android with iOS and Web.
• Added Document Capture V2 module. Available when the V2 feature gate is enabled.
• Added DocumentScan.Builder.setDocumentSources(...) to configure which submission methods (CAMERA, FILE_UPLOAD, IMAGE_UPLOAD) appear on the Document Capture chooser. Defaults to all three. For document types that don't accept PDFs, FILE_UPLOAD is dropped only when another source remains; configuring exactly FILE_UPLOAD on such a type is rejected with a configuration error before launch. Honored by both V1 and V2: in V1 the set refines the provider options chooser shown via setShowDocumentProviderOptions(true); with that chooser disabled, V1 remains camera-only.
• Added Email V2 module. Available when the V2 feature gate is enabled.
• Refreshed the CombinedConsent module UI to align with the latest Incode design and added dark-mode support.

Added (STANDARD mode only)

• Added Custom Watchlist V2 module. Available when the V2 feature gate is enabled, with dark-mode support.

Fixed (ALL modes)

• Fixed the first streaming recording sometimes missing at onboarding start due to a token timing issue.
• Fixed Face Login reopening the camera and capturing a second time after a successful login flow completed.
• Improved video-liveness recording reliability on devices with flaky camera HAL (e.g. some MediaTek-backed Samsung models): when the camera is invalidated mid-recording and CameraX never delivers the Finalize event, the SDK now salvages any partial MP4 already written to disk and queues it for upload instead of dropping the recording.
• Security improvements.
• Improved accessibility behavior for phone input field.
• Fixed a crash in the CombinedConsent module when system font size is set to maximum.
• Fixed SelfieScan auto-capture being slow or failing to fire on Pixel 6 Pro and other high-density-screen devices in portrait, due to an overly tight face position constraint introduced in 5.45.0.
• Fixed the camera preview being visible on the status bar / notification line during SelfieScan, Face Authentication, and Face Login capture.
• The SDK no longer contributes an io.sentry.proguard-uuid <meta-data> entry to the host app's merged manifest.
• Fixed the IdScan V2 module to respect the configuration when the setShowRetakeScreenForManualCapture() method in the IdScan.Builder class is set to false.
• Fixed a Duplicate class build failure when integrating the onboard SDK alongside another library whose obfuscated classes occupy the root JVM package.
• Fixed unexpected focus jumps in Dynamic Forms fields.
• Added @since Deprecated in <version> tags to previously-undocumented deprecated public APIs across the SDK, so consumers can see at a glance when each API was deprecated.
• Rewrote the deprecation messages on IncodeWelcome.fetchAllFlows(), IncodeWelcome.fetchFlow(), IncodeWelcome.downloadLibraries(), IncodeWelcome.isLibrariesReady(), IncodeWelcome.subscribeForLibrariesReady(), and the LibraryDownloadError enum to name the recommended replacements.
• Fixed the IdScan V2 success screen displaying "Continue" instead of "Let's continue" on the label shown after a successful ID capture.
• Fixed back-of-ID streaming video not being recorded when the ID is configured as a separate back-only scan (ScanStep.BACK). The back-side recording is now finalized and uploaded like the front side.
• Improved error reporting when the E2EE key-exchange (getPublicKey) request fails: the resulting error now includes the HTTP status code and the server's error detail instead of a generic message.
• Fixed a crash in the Video Selfie module that occurred when the app was minimized while the recorded video was uploading, which left the session marked as Not Completed.

Deprecations (ALL modes)

• Deprecated IncodeException.DeviceEnvironmentException and IncodeException.isDeviceEnvironmentException(). Both are unreachable at runtime - the SDK process terminates on detection before this exception can be delivered. Remove any catch blocks or calls referencing these; they are dead code. Both will be removed in a future release.
• Deprecated SelfieScan.FaceAuthMode.SERVER. This enum case should not be used for new integrations. Use the FaceAuthentication module instead. SelfieScan.FaceAuthMode.LOCAL (offline Face Login) is not affected.
• Deprecated DocumentScan.Builder.setShowTutorials(...) and DocumentScan.Builder.setShowDocumentProviderOptions(...) for V2. Both are ignored by the V2 Document Capture module — use setDocumentSources(...) to configure the chooser. Still honored in V1.

Updated dependencies

• org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.20 -> org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.25
• org.jetbrains.kotlin:kotlin-reflect:1.9.20 -> org.jetbrains.kotlin:kotlin-reflect:1.9.25
• org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.20 -> org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25
• org.jetbrains.kotlin:kotlin-serialization:1.9.20 -> org.jetbrains.kotlin:kotlin-serialization:1.9.25
• com.google.devtools.ksp:1.9.20-1.0.14 -> com.google.devtools.ksp:1.9.25-1.0.20
• kotlinCompilerExtensionVersion 1.5.4 -> 1.5.15
• com.guardsquare:dexguard-gradle-plugin:9.14.2 -> com.guardsquare:dexguard-gradle-plugin:9.14.3

Fixed (STANDARD mode only)

• Fixed the SDK's built-in Result screen failing to display the user score in non-E2EE flows, due to the deprecated /omni/get/report endpoint returning HTTP 500 during an eager pre-fetch on screen entry. The screen now loads results without calling the removed endpoint, and the unused "Reports" button has been removed.
• Fixed loss of the persisted session token after the app process was killed, which caused authenticated requests to fail with HTTP 401 and prevented onboarding from resuming. The token is now retained across process death so flows continue without re-authentication.
• Fixed the ID capture captureAttemptFinished event being reported with the wrong name in UXV2 frame-logging flows, so the event now matches the value emitted by all other flows.

Module Versions

• core-light 3.0.14
• nfc 1.5.5

Version 5.48.0 - 2026-May-22

Added (ALL modes)

• Added Hebrew (he-IL) localization for the onboard SDK module. Pass he-IL to CommonConfig.Builder.setLocalizationLanguage(...) to render the SDK UI in Hebrew, and to SessionConfig.Builder.setLanguage(...) to enable Hebrew voice-consent transcription. (Both he-IL and the legacy Java-style he_IL form are accepted by setLocalizationLanguage. The Android resource folder uses the legacy ISO 639-1 qualifier values-iw/ internally — this is a platform requirement and not an integrator-facing identifier.)
• Lottie animations and vector drawables in V2 modules (IdScan, SelfieScan) now inherit colors from the SDK color scheme, aligned with the ID capture design guidelines and face capture design guidelines. Customer-overridden animation resources are automatically detected and left unchanged.
• Local Room databases are now encrypted at rest using SQLCipher. Existing unencrypted databases are automatically migrated to encrypted format on first access. See Licenses for the SQLCipher attribution that must be reproduced if your app ships an open-source licenses screen.
• Added a persistent dim overlay around the silhouette on the SelfieScan V2 manual capture screen.
• Added Phone V2 module. Available when the V2 feature gate is enabled.

Added (STANDARD mode only)

• Added support for verifying identity using Google Wallet IDs within the IdScan module, via the new optional com.incode.sdk:wallets dependency. Enable per-module with IdScan.Builder.setGoogleWalletIdEnabled(true), and switch between production and sandbox environments via IncodeWelcome.Builder.setGoogleWalletEnvironment(...). The optional wallets module requires minSdk 28.

Fixed (ALL modes)

• Fixed an issue where Kotlin interface callbacks with default implementations in the onboard module required empty overrides from Java integrators; they are now emitted as Java default methods and are optional overrides for both Kotlin and Java integrators. This includes the per-attempt SelfieScanListener and IdScanListener callbacks introduced in 5.47.0:
  • SelfieScanListener.onSelfieScanReady
  • SelfieScanListener.onSelfieScanAttemptCompleted
  • IdScanListener.onIdScanReady
  • IdScanListener.onIdFrontAttemptCompleted
  • IdScanListener.onIdBackAttemptCompleted
• Face Authentication V2 module: Fixed SelfieScan.Builder().setCaptureAttempts not being respected when the captured selfie did not match the identity provided via CommonConfig.Builder().setFaceAuthenticationHint(...); the flow ended after the first attempt instead of allowing the configured number of retries.
• Fixed button label clipping on long or translated strings: IncodeButton now auto-sizes its text, shrinking the font before adding ellipsis, and wraps multi-word labels to two lines.
• Security improvements.
• Fixed the verification-complete confirmation message in ApproveActivity and the overall score in ResultsActivity (the SHOW_RESULTS module) not being announced as accessibility headings by TalkBack.
• Accessibility improvements in the Dynamic Forms module.
• Fixed Login flow rendering the legacy selfie tutorial instead of the V2 tutorial when showTutorials was enabled.
• Updated the Proof of Address tutorial screen design and improved the layout of the review screen.
• Fixed inconsistent V1/V2 UX rendering across onboarding modules within a single flow. The V2 feature gate is now properly awaited before the first module starts, so IdScan, SelfieScan, and other modules consistently render the same UX version.
• Corrected typos, grammar, and British-English spellings in customer-facing Javadoc, KDoc, and Markdown documentation.
• Fixed SelfieScan.Builder.setLogo(...) not being applied to the toolbar on the V2 selfie capture screen.
• Changed the default values of the setHeadCoverCheckEnabled() and setMaskCheckEnabled() methods to true in the SelfieScan.Builder.
• Changed the default values of the setHeadCoverCheckEnabled() and setMaskCheckEnabled() methods to true in the VideoSelfie.Builder.
• Fixed a Spanish localization typo on the camera permission screen: Salir del processo is now Salir del proceso.

Fixed (STANDARD mode only)

• Fixed a VideoSelfieActivity crash when Android recreates the activity while the video selfie upload screen is being restored.
• Fixed a rare crash (FileNotFoundException / UndeliverableException) during selfie video upload when SelfieScanVideoRecordVideo.mp4 was missing or unflushed at upload time. Failures now route through the standard retry UI / SelfieScanListener.onError path instead of crashing the flow.

Added dependencies

• androidx.credentials:credentials:1.5.0 (required only when using the new optional wallets module)
• androidx.credentials:credentials-play-services-auth:1.5.0 (required only when using the new optional wallets module)
• net.zetetic:sqlcipher-android:4.6.1

Module Versions

• core-light 3.0.13
• nfc 1.5.4
• wallets 1.0.0 (new optional module)

Version 5.47.0 - 2026-May-07

Added (ALL modes)

• Updated core-light module to v3.0.12: incorporating libRecogKitAndroid.so v3.9.1; updating the on-device liveness model used by SelfieScan and FaceAuthentication (model-liveness-detection 3.2.2)
• Added allAttemptsExhausted flag to IdScanResult and SelfieScanResult indicating when capture or upload retries are no longer available.
• Added per-attempt IdScan callbacks onIdFrontAttemptCompleted / onIdBackAttemptCompleted to IdScanListener (and IncodeWelcome.OnboardingListener). They fire after every individual capture attempt, including intermediate failures. The terminal attempt is signaled when IdScanResult.allAttemptsExhausted is true or when the attempt succeeds.
• Added per-attempt SelfieScan callback onSelfieScanAttemptCompleted to SelfieScanListener (and IncodeWelcome.OnboardingListener). It fires after every individual selfie capture attempt, including intermediate failures. The terminal attempt is signaled when SelfieScanResult.allAttemptsExhausted is true or when the attempt succeeds.
• Added missing Javadocs for IncodeWelcome entry-point APIs.
  • startOnboarding(...)
  • startOnboardingSection(...) (all overloads)
  • startWorkflow(...)
  • startFaceLogin(...) (all overloads)
  • startFlow(...) (all overloads)
  • startFlowFromDeeplink(...) (all overloads)
  • finishOnboarding(...)
• Added Geolocation.setSkippable(boolean) to control what happens when the user denies the location permission and taps Skip this step in the V2 flow. When skippable, the flow continues; otherwise it ends with OnboardingListener.onError (and OnboardingListener.onGeolocationUnavailable). The flag is also wired up to the dashboard's Allow user to skip geolocation toggle for both Flows and Workflows configurations.
• Updated the V2 Geolocation skip button label to read Skip this step when Geolocation.setSkippable(true) and Quit process when Geolocation.setSkippable(false), on both the permission-denied and location-unavailable screens.
• Added LocationPermissionDeniedException, raised by the V2 Geolocation flow when the user exits from the permission-denied screen. GeolocationUnavailableException is now reserved for the location-unavailable and max-retries exit paths.

Added (STANDARD mode only)

• Added an on-device face occlusion check available in SelfieScan (V1 and V2) and FaceAuthentication. Configure it locally via setFaceOcclusionEnabled(...) and setFaceOcclusionSeverity(...) on the respective Builder classes, or from the dashboard's isOcclusionEnabled / occlusionSeverity settings for the respective modules. The feature requires the new optional com.incode.sdk:model-face-occlusion dependency.
• Added the setOnDeviceFaceResultsSubmissionEnabled() API to the SelfieScan V2 module to support on-device face processing. When enabled, liveness detection and age estimation run entirely on the user's device. No biometric images leave the SDK.
  • setOnDeviceFaceResultsSubmissionEnabled() requires E2EE, supports auto-capture only, and has other configuration constraints. See the On-Device Age Estimation guide and the Javadoc for more details. for more details.
• Implemented on-device age estimation in the SelfieScan V2 module behind setOnDeviceFaceResultsSubmissionEnabled(), available via the new optional com.incode.sdk:model-age-estimation dependency.
• Added Digital ID validation for selected PDF files to reject uploads larger than 5 MB with an appropriate error state.

Fixed (ALL modes)

• Updated the SDK's internal encrypted storage to a more reliable, future-proof implementation. Existing data is migrated transparently on first launch after upgrade.
• Improved reliability of internal encrypted storage on low-end devices that previously experienced intermittent encryption failures.
• Fixed an issue where Behavioral Trust results were reported as unknown.
• Removed internal SDK implementation details from the Javadoc that were not relevant to integration.
• Fixed missing back-side tutorial in the IdScan V2 flow when IdScan.ScanStep.BACK is used with ID tutorials enabled.
• Fixed IdScan V2 reporting IdScanResult.scanStatus = RESULT_ERROR_UNKNOWN for wrong-document-side captures; now correctly reports RESULT_ERROR_WRONG_ID_SIDE.
• Fixed an issue where IncodeWelcome.startWorkflow() only logged a ModuleConfigurationException at startup and did not invoke OnboardingListener.onError().
• Fixed the image quality severity configured on the Dashboard being ignored by the SelfieScan module; the configured severity is now honored.
• Fixed a rare camera stack issue where IdScan or SelfieScan could fail during capture on certain devices.

Module Versions

• core-light 3.0.12
• model-liveness-detection 3.2.2
• model-face-occlusion 0.2.0 (new optional module)
• model-age-estimation 2.2.2 (new optional module)

Added dependencies

• androidx.datastore:datastore:1.1.7
• com.google.crypto.tink:tink-android:1.21.0

Version 5.46.0 - 2026-Apr-27

Added (ALL modes)

• Added accessibility (TalkBack) support for all Dynamic Forms input fields. Screen readers now announce field labels, required state, current values or hints, and validation errors.
• Face Authentication: Enriched unknown error reporting with original exception details and cause chain for better diagnostics on the Dashboard.
• Added the possibility to enable UXV2 modules directly from the Dashboard configuration.
• Enabled high resolution ID and Face capture via clientExperimentId. Pass high_res_capture (optionally combined with other experiments using |, e.g. experimentV2|high_res_capture) to opt in.
• Migrated the CURP module to the V2 design system (Compose), including a "Non-Binary/Other" gender option.

Fixed (ALL modes)

• Migrated Dynamic Forms text, date, select, and yes/no fields from legacy theme to V2 design system (IncodeTheme), applying consistent styling to match the previously updated phone and country selector inputs.
• Improved TalkBack accessibility in the IdScan V2 module: better semantic grouping, button roles, content descriptions, live region announcements, and focus management.
• Improved button accessibility in V2 Compose screens.
• The SelfieScan module outline ring now inherits its coloring from the color scheme, aligned with the face capture design guidelines.
• Improved accessibility behavior for Compose-based SDK modal components by adding stronger dialog semantics and deterministic initial focus handling for permission and picker dialogs.
• Fixed the overlay transition around the silhouette for SelfieScan V2 module.
• Fixed incorrect initial TalkBack focus in IdScan V2 by hiding interactive elements during pre-initialization and controlling traversal order for buttons and the module header.
• The SDK now throws an ExternalTokenRequiredException when a /0 URL is configured and no external token is provided — either the base URL, or the E2EE URL while E2EE is enabled. Previously, the E2EE variant caused a crash with lateinit property has not been initialized in the E2EE interceptor.
• Fixed an issue where video recording could fail if the recording directory did not exist before starting recording.
• Improved ID capture sharpness on the CameraX (V2) camera stack: enabled best-candidate selection during the capture countdown, and prevented automatic macro camera switching on multi-camera devices (API Level 28+).
• Restored missing camera-opened analytics events on the V2 capture path.
• Fixed a DexGuard class-inlining issue where optional dependency references (Huawei, Sardine) could be merged into SDK classes, causing runtime crashes when those dependencies are not present.
• Fixed dynamic localization not being applied in UXV2 modules due to the localized Context not being propagated. The issue was introduced in 5.45.1.
• Fixed an issue where Behavioral Trust results were reported as unknown.
• Fixed an issue where Behavioral Trust results were incorrectly reported as a failure on certain devices.
• Improved Lottie animation playback smoothness on the ID capture tutorial screen.
• Improved camera compatibility, reducing false unsupported-device errors.
• Fixed an issue where the QES and AES module activities did not close after publishing results.
• Introduced unified searchable and plain dropdown components — used by Dynamic Forms (country selector, select inputs) and the CURP V2 module — with improved TalkBack announcements, focus handling, and validation feedback. The country selector now supports searching (type to filter).

Fixed (STANDARD mode only)

• Fixed IncodeWelcome.SSLConfig not being accessible as a public API and custom SSL configuration not being applied correctly.

Module Versions

• core-light 3.0.11

Updated dependencies

• com.squareup.okhttp3:logging-interceptor:4.9.3 -> com.squareup.okhttp3:logging-interceptor:4.12.0
• org.json:json:20180813 -> org.json:json:20251224

Version 5.45.1 - 2026-Apr-03

Added (ALL modes)

• Added dark mode support for drawables in V2 modules. Custom drawables can now provide a drawable-night variant that is automatically resolved based on the active display mode.
• Added MODULE_VERSION info for SelfieScan, FaceAuthentication and FaceMatch modules to the module-opened analytics event.

Fixed (ALL modes)

• IdScan and SelfieScan V2 modules now survive configuration changes (e.g., theme change).
• Fixed close header button visibility issue on the manual photo review screen in IdScan V2 flow.
• Fixed an issue where the manual capture button in the SelfieScan V2 module was not properly announced by TalkBack because it did not have a contentDescription.
• Fixed setShowFooter(false) not being applied in the Geolocation V2 module - the footer was always visible regardless of the IncodeUXConfig setting.
• Fixed missing "Get Ready" circle spinner on selfie capture when face re-enters constraints after being lost or after capture timeout.
• Improved selfie ML model loading performance: models now load lazily on a background thread and in parallel, reducing main thread blocking during SDK initialization and selfie screen startup.

Module Versions

• core-light 3.0.10

Version 5.45.0 - 2026-Mar-23

API Changes (refer to Migration Guide for details)

• Removed the transition/loading screen that was shown between modules. Any customizations related to this screen (e.g., overriding onboard_sdk_activity_transition.xml, IncodeTransitionScreenState) can be safely removed.
• IdScan module: document chooser visibility is now controlled only by Flows and setShowIdTypeChooser(...). Setting idType no longer hides the chooser. Please see Migration Guide for details.
• Security improvements.

Added (ALL modes)

• Added German localization.
• Extended the module customization functionality to align with the recent design guidelines. Updated the IdScan V2 module to use the new customization system.
• Added Geolocation Module V2. Like other V2 modules (IdScan, SelfieScan, ProcessId, FaceMatch), it is available when the feature gate is enabled.
• Implemented new camera loading indicator in IdScan V2 module.
• IdScanResult.idImageBase64 is now populated in all modes in IdScan V2. Previously, it was only available in Capture-Only mode.
• Updated the document chooser screen in V2 IdScan module to always use a more compact design and to show documents dynamically based on the module configuration.
• Strengthen device environment checks.
• SelfieScan V2: tablets are now landscape-locked with an optimized layout. Phone devices remain portrait-locked.
• Updated UI for the Permission screens in the IdScan and SelfieScan V2 modules.
• Improved feedback during ID capture in the IdScan V2 module, with different labels shown in Standard and Capture-Only mode.

Added (STANDARD mode only)

• Ported these additions from 5.40.2:
  • Added ability to pass SessionConfig to IncodeWelcome.startFaceLogin() API. This allows enabling of end-to-end encryption (E2EE) in Face Login mode.
  • Face Login: Security improvements
• Added support for ASYNC modules in Workflows. Currently applies to the VideoSelfie module, where the /omni/finish-status endpoint is handled on the backend.

Fixed (ALL modes)

• Bumped DexGuard plugin to 9.13.3 to fix an OOM error caused by bloated consumer ProGuard rules shipped with the AAR.
• Updated the position of the capture frame on the screen according to the capture screen specification for the IdScan V2 module.
• Updated the camera feed positioning in the SelfieScan module.
• Adjusted the SelfieScan module UI to align with the UXv2 styling, including new success/error screens, animations, and transitions.
• Fixed potential crashes when backgrounding an app with a Camera-based module (IdScan, SelfieScan, etc) on screen and returning to the app
• Fixed a rare crash during ID capture upload caused by out-of-bounds bitmap coordinates.
• Fixed an issue with location fetching in the Geolocation module; Unavailable location is now handled by falling back to requesting location updates.
• Aligned error screens for the IdScan V2 module with recent design guidelines.
• Updated capture instructions on success screen in the IdScan V2 module.
• Fixed an intermittent error in frame analyzers caused by a race condition in concurrent frame processing.
• Fixed the app getting stuck during IdScan when the user declines the screen recording permission with configureScreenRecording(true, false) config.
• Fixed image quality checks severity in the SelfieScan and FaceAuthentication module so that configured thresholds are consistently honored across SDK-based and Dashboard-based configurations.
• Update Close icon on all screens with close button configured, and Help icon on ID Capture V2 screen
• Fixed a NullPointerException that could occur when calling IncodeWelcome.deleteUserLocalData() if a temporary images directory failed to create.
• Fixed potential NullPointerExceptions and ConcurrentModificationExceptions that could occur in the SelfieScan module when determining the horizontal view angle of the camera.
• Fix content centering problems for the Face Match V2 module
• Fixed an issue where the Device Trust check in Deepsight could be marked as "unknown".
• Face Authentication: The progress text now shows "Uploading" instead of "Verifying".

Fixed (Capture-Only mode)

• Improved functionality of the feature flag mechanism when using setClientExperimentId, particularly in Capture-Only and Delayed modes.

Fixed (STANDARD mode only)

• Updated the HTTP method for /omni/finish-status from GET to POST

Module Versions

• core-light 3.0.9
• nfc 1.5.3

Updated dependencies

• com.guardsquare:dexguard-gradle-plugin:9.13.1 -> com.guardsquare:dexguard-gradle-plugin:9.13.3

Removed dependencies

• com.guardsquare:dexguard-runtime

Version 5.44.0; core-light 3.0.8 - 2026-Feb-25

API Changes (refer to Migration Guide for details)

• DocumentType has been moved

Added (ALL modes)

• Added support for a bill of materials (BOM) that can be used when integrating libraries from the Incode Omni SDK. Please refer to the Incode Bill of Materials (BOM) section of the Setup Guide and Migration Guide for further details.
• Added a lot of missing Javadocs in the following packages/classes/methods of com.incode.welcome_sdk.:
  • CommonConfig.Builder.setShowCloseButton()
  • commons.exceptions.*
  • commons.exceptions.IncodeException.CaptureRetryAttemptsExceeded
  • commons.exceptions.IncodeException.DeviceEnvironmentException.*
  • commons.exceptions.video_selfie.*
  • data.*
  • data.Event.*
  • IncodeWelcome.Builder.setTestModeEnabled()
  • listeners.*
  • modules.*
• Added a new encryption layer to data the SDK stores in SharedPreferences.

Added (STANDARD mode only)

• Updated the FaceMatch module to UxV2. This update also introduces a new SDK API: FaceMatch.Builder.setShowLivenessResult().

Added (Capture-Only mode)

• Added the presignedVideoFilePath parameter to the SelfieScanResult model when SelfieScan.Builder.()setVideoLivenessRecordingEnabled() is enabled

Fixed (ALL modes)

• Fixed recording being cut off at the beginning and occasional video missing in SelfieScan and IdScan.
• Fixed an issue where the "No internet" bottom bar UI would overlap with the bottom navigation buttons when targetSdk is 35+
• Updated manual capture text in the SelfieScan module. Updated the manual capture button icon and the layout alignment.
• Added the missing default outer grey circle camera border in the SelfieScan module.
• Fixed an issue where the onSSLPinningFailed() callback was not called when using startOnboardingSection()
• Fixed letter spacing in the MINIMAL variant of realtime feedback messages in the IdScan module.
• Updated text on the Tutorial and Capture screens in the IdScan V2 module to reflect US Smart Capture.
• Fixed an issue where the close button could not be shown in the SelfieScan module.
• Added missing exclamation mark to the "Success" state message in SelfieScan.
• Fixed an issue where IncodeWelcome.deleteUserLocalData() was not deleting video liveness and screen recordings from the IdScan and SelfieScan modules.
• Fix session breaking issues in the IdScan V2 flow when the user scans the front side of the document with a covered face.
• Updated the V2 flow maximum header logo height.
• Prevent ConcurrentModificationException in IdScan and SelfieScan V2 that could occur randomly when capturing the photos.

Added dependencies

• androidx.security:security-crypto-ktx:1.1.0

Updated dependencies

• com.guardsquare:dexguard-gradle-plugin:9.12.6 -> com.guardsquare:dexguard-gradle-plugin:9.13.1
• com.guardsquare:dexguard-runtime:9.12.6 -> com.guardsquare:dexguard-runtime:9.13.1

Version 5.43.0; core-light 3.0.7; nfc 1.5.2 - 2025-Dec-30

Added (ALL modes)

• Added support for allowSkipDocumentCapture configuration for the DocumentScan module, allowing users to skip document capture when enabled. Added isDocumentValidationSkipped field to DocumentValidationResult to indicate when document validation was skipped.
• Updated wording in the SelfieScan V2 module to improve clarity and user guidance during the selfie capture process.
• Added getDocumentImage() method to the DocumentValidationResult class, which returns the document image as a Bitmap.
• Added "minimal" option for the real time feedback shown in the IdScan V2 module. This can be configured via IncodeUXConfig.Builder().setRealtimeFeedbackMessageUIFlavor(). Available options are RealtimeFeedbackMessageUIFlavor.STANDARD and RealtimeFeedbackMessageUIFlavor.MINIMAL.
• Updated Javadoc for IncodeWelcome.Builder().setClientExperimentId() to better reflect proper usage.
• Updated UI in the FaceMatch module for compact UI mode. This feature can be enabled via FaceMatch.Builder().setFaceMatchAnimationEnabled(false).
• Performance improvements.
• Added missing Javadocs for the following SDK APIs:
  • Introduced with Dynamic Localization in 5.3.0:
    • IncodeWelcome.setStrings()
    • IncodeWelcome.setStringArray()
    • IncodeWelcome.setQuantityStrings()
  • Introduced with the FaceAuthentication module in 5.40.0:
    • FaceAuthenticationListener
    • FaceAuthenticationResult
    • IncodeWelcome.setFaceAuthenticationHint()
• Security improvements.
• New Transition screen layout. This screen is now customizable using the new V2 theming system. Check the Migration Guide for more details.
• Updated UI for Need Help screen in the IdScan V2 module.
• Added setHeaderAlignment() method to IncodeUXConfig.Builder to configure alignment of the Header on the applicable screens. Available options are HeaderAlignment.START, HeaderAlignment.CENTER (default), and HeaderAlignment.END.
• Added PDF417 barcode support to the IdScan V2 module, enabled per-flow through the dashboard via the US Smart Capture setting.
• Added support for customizing button styles through IncodeComponents. Buttons used in V2 modules can now be configured with custom colors for different states (default, hover, pressed, disabled), borders width, color and radius. See SDK Customization Guide for details on component configuration.

Added (STANDARD mode only)

• The error field in IdScanResult is now populated when retry attempts are exhausted. The resultCode is set to SUCCESS because the flow continues. This change applies only to IdScan V2, as adding it to V1 would be a breaking change.
• Added a specific error message for cases where face occlusion is detected in the SelfieScan and FaceAuthentication modules.
• Refactored SelfieScan and Face authentication V2 modules to use Compose UI. These modules are now customizable using the V2 theming system. Check the Migration Guide for more details.

Fixed (ALL modes)

• Fixed an issue where the Behavioral Trust check in Deepsight could get an unknown result on lower-end devices
• Fixed an issue where the Behavioral Trust check in Deepsight would always get an unknown result if SelfieScan v2 was used in the session
• Fixed a potential OutOfMemoryError with long, repeated use of the NfcScan module.
• Fixed an issue where some legacy model files could be retained on the device following an update of the Android SDK.
• Fixed a compatibility issue that caused crashes on Android 14 and earlier due to conflicts between Kotlin extension methods and Java methods introduced in Android 15. This ensures compatibility across all Android versions.
• Fixed an issue where video upload failed in Face Login mode when using video streaming.
• Fixed an issue in the SelfieScan module where tutorials were incorrectly skipped in Face Login mode when SelfieScan V2 was enabled.
• Improved error handling in video streaming initialization by checking for required dependency first, before checking for available RAM.
• Fixed an IllegalStateException that could occur in the IdScan v2, SelfieScan v1, and SelfieScan v2 modules when the camera was determining what features it supports
• Fixed a CalledFromWrongThreadException crash in the SelfieScan module that could occur randomly.
• Fixed a NullPointerException crash caused by the app failing to access the external files directory. This issue was mostly affecting Pixel devices on Android 15/16 (and possibly others)
• Fixed an issue that caused the SDK to stop producing logs in certain cases.
• Fixed an issue where phantom analytics events were being logged in the IdScan V2 module when the Passport is selected.
• Fixed an error that would occur when reading a certain type of NFC chip in the NfcScan module.
• Fixed an issue where the NfcScan module did not respect the nfcMaxRetries setting when an NFC read failed due to (possibly) incorrect OCR data.
• Fixed an issue where the camera hardware cannot be found when the host application is built with ProGuard or R8 enabled.
• Fixed an issue where the flow got stuck on the Transition screen when the camera permission was denied in the FaceAuthentication module.

Fixed (STANDARD mode only)

• Fixed a potential OutOfMemoryError with long, repeated use of workflows.
• Fixed an issue in SelfieScan module where the UI would get stuck when manual review is triggered after capture attempts are exhausted. The flow now finishes immediately with an error instead of showing broken UI.
• Fixed an issue in the IdScan module where Back ID scan would start unexpectedly for one-sided documents after pausing and resuming the app.

Fixed (Capture-Only mode)

• Fixed an issue where the Behavioral Trust check in Deepsight would always display an unknown result if SelfieScan v1 was used in the session due to relevant data missing when invoking SelfieScanResult.metadata.
• Fixed an issue where the Device Trust check in Deepsight would always display a potentially false "PASSED" result if SelfieScan v1 was used in the session due to relevant data missing when invoking SelfieScanResult.metadata.

Fixed (Submit-Only mode)

• Fixed a NullPointerException that happens when publishing the result in the Selfie module.

Version 5.42.0; core-light 3.0.6; nfc 1.5.1 - 2025-Nov-28

Added (ALL modes)

• Upgrading compileSdk to level 35 is required. Please see Migration Guide for details.
• Added Age Assurance UX to the IdScan V2.
• Added croppedDocumentPath field to IdScanResult (applicable only to IdScan v2 module), containing the file path to the cropped document image.
• Added a Review Photo screen in the IdScan v2 module, shown after the user captures an ID. This feature can be enabled using the setShowRetakeScreenForAutoCapture() and setShowRetakeScreenForManualCapture() methods in IdScan.Builder.

Added (STANDARD mode only)

• Added info describing which API and configurations were used for starting the SDK to the "Sdk Info" event.
• Added a specific error message for cases where face image quality is too low in the SelfieScan module.
• Workflows: added the option to prefill the phone number in the Phone module based on the user's previously stored identity.

Added (STANDARD mode only)

• Added support for CustomModule in Workflows, allowing integrators to pause a flow, execute custom logic, and resume at the module's next node. The configured callbackName is provided as a string for custom handling.

Fixed (ALL modes)

• Fixed an issue on Android 14+ devices where the SelfieScan module could crash after screen recording permission is granted if an active camera preview is showing. The issue was introduced in 5.36.0.
• Fixed a potential IllegalStateException that could occur in the following modules after the app was in the background and came back.
  • Conference
  • CurpValidation
  • IdScan V2
  • VideoSelfie
• Fixed UI issues for targetSdk 35
• Refactored exception handling with dedicated hierarchies: IncodeException.PermissionNotGranted (camera, microphone, location, NFC) and IncodeException.DeviceEnvironmentException (emulator, hooking, virtual environment, root detection). See the Migration Guide for details.
• Fixed an issue where liveness was incorrectly shown as "failed" in the FaceMatch module if it came after the FaceAuthentication module.
• Fixed crashes on Android 6 that could happen on various screens. The error message was "Error inflating class ImageView".

Fixed (STANDARD mode only)

• Fixed an issue where the settings for Closed Eyes and Head Cover checks were not respected in the SelfieScan and Face Authentication modules when using Workflows.
• Fixed an issue in the SelfieScan module where streaming did not record subsequent face capture attempts after the first failed attempt.
• Fixed a crash in the FaceAuthentication module when receiving unknown error codes (e.g., SELFIE_FACE_OCCLUDED) from the server. Unknown error codes will be mapped to UNKNOWN instead of throwing an exception.
• Fixed an issue in the SelfieScan module where use of both Deepsight Video Liveness and video streaming via setStreamFramesEnabled(true) would log a "Video Streaming Session Failed Due To An Error" event with a SessionNullOrInvalidParameter error code. If both of these features are enabled, video streaming will be ignored.
• Fixed an issue where a log message could appear about the device not having enough RAM to support video streaming when the 'video-streaming' dependency wasn't included.
• Updated log messages related to missing optional dependencies to provide clearer debugging information.
• Removed borders around the images in FaceMatch module.

Removals/Deprecations

• Removed the "Referred to executive" screen from the IdScan v2 module, and deprecated the ProcessId.Builder.setEnableIdSummaryScreen() method.

Updated dependencies

• androidx.activity:activity-compose:1.8.2 -> androidx.activity:activity-compose:1.10.1
• androidx.camera:camera-camera2:1.4.2 -> androidx.camera:camera-camera2:1.5.1
• androidx.camera:camera-extensions:1.4.2 -> androidx.camera:camera-extensions:1.5.1
• androidx.camera:camera-lifecycle:1.4.2 -> androidx.camera:camera-lifecycle:1.5.1
• androidx.camera:camera-video:1.4.2 -> androidx.camera:camera-video:1.5.1
• androidx.camera:camera-view:1.4.2 -> androidx.camera:camera-view:1.5.1
• androidx.fragment:fragment:1.6.2 -> androidx.fragment:fragment:1.8.9
• com.android.tools.build:8.1.4 -> com.android.tools.build:8.6.0
• com.google.dagger:dagger:2.48.1 -> com.google.dagger:dagger:2.57.2
• com.google.dagger:dagger-compiler:2.48.1 -> com.google.dagger:dagger-compiler:2.57.2
• gradle-8.0-bin.zip -> gradle-8.7-bin.zip
• io.insert-koin:koin-android:3.5.3 -> io.insert-koin:koin-android:4.0.4
• io.insert-koin:koin-androidx-compose:3.5.3 -> io.insert-koin:koin-androidx-compose:4.0.4

Version 5.41.1 - 2025-Nov-12

Fixed (ALL modes)

• Fixed an issue where capturing an image in the IdScan and DocumentScan v1 modules, as well as the SelfieScan v1 and v2 modules, could be slow. For IdScan and DocumentScan, this could render the "Help" button unresponsive. For the SelfieScan module, this could cause the post-capture phase to take longer. This issue was introduced in 5.41.0

Version 5.41.0; core-light 3.0.5; nfc 1.5.0 - 2025-Oct-17

Added (ALL modes)

• Updated core-light module to v3.0.5: incorporating face attributes model v1.3. New model offers improved detection of hats, masks, eyeglasses, and closed eye detection. Also, multiple face attributes can now be detected at the same time.
• Added Age Assurance UX to the Selfie V2.
• Added support for optional fields in DynamicForms module.
• Added ProcessId V2 module with support for design tokens.
• Added number of remaining ID capture attempts to IdScan v2 error screen.
• Added realtime feedback when head coverings (such as hats) are detected. This feature can be enabled using the setHeadCoverCheckEnabled() method in SelfieScan.Builder and VideoSelfie.Builder, or in the corresponding module configs on the Dashboard.
• Added support for 16KB page size devices to the nfc module. More info here.
• Added Digital ID PDF upload flow to the IdScan module.
  • Introduced a new IdType called DIGITAL_ID.
  • Added a new API method, setDigitalIdEnabled() in IdScan for enabling the digital ID option on the Document chooser screen.
• Updated the documentation for following IncodeWelcome.Builder APIs to better indicate what happens when disabled.
  • disableEmulatorDetection()
  • disableHookCheck()
  • disableRootDetection()
  • disableVirtualEnvironmentDetection()

Added (STANDARD mode only)

• Added support for the US Smart Capture option of the IdScan v2 module. This is the optimized capture flow for US IDs which captures the back of the ID in order to extract data from the barcode. Exclusively available with DMV Face Match.
• Improved StatSig configuration to enable feature gate segmentation per-flow.
• Security improvements.

Fixed (ALL modes)

• UI Improvements in IdScan v2.
• Fixed an issue where liveness was incorrectly shown as fail in the FaceMatch when the Video Selfie module was used as the Selfie.
• Fixed swapped ES/PT translations for the "Quit process" button on the V2 Permission Request screen.
• Fixed a crash in the Selfie module due to CalledFromWrongThreadException.
• Code security improvements.
• Fixed DexGuard configuration to preserve Kotlin metadata, allowing Named Arguments to be used in IncodeWelcome.Builder.

Fixed (STANDARD mode only)

• Fixed an issue where end-to-end encryption (E2EE) was not applied when using external token, causing requests to be sent unencrypted.
• Added storing of the customerUUID in the SelfieScan module when using Face Login (1:N) mode with SelfieScan.storeAuthenticationEnabled(true). The value appears in the Incode Dashboard > Authentication tab after authentication sync completes.

Updated dependencies

• com.github.Tgo1014:JP2ForAndroid:1.0.4 -> dev.keiji.jp2:jp2-android:1.0.5
• com.guardsquare:dexguard-gradle-plugin:9.12.2 -> com.guardsquare:dexguard-gradle-plugin:9.12.6
• com.guardsquare:dexguard-runtime:9.12.2 -> com.guardsquare:dexguard-runtime:9.12.6

Version 5.40.3 - 2026-Jan-30

Fixed (STANDARD mode only)

• Fixed an issue where end-to-end encryption (E2EE) was not applied when using external token, causing requests to be sent unencrypted.

Version 5.40.2 - 2026-Jan-08

Added (STANDARD mode only)

• Added ability to pass SessionConfig to IncodeWelcome.startFaceLogin() API. This allows enabling of end-to-end encryption (E2EE) in Face Login mode.
• Face Login: Virtual environment checks are now always performed, even when disabled in configuration. The login flow aborts if any check fails.
• Face Login: Security improvements

Fixed (ALL modes)

• Fixed an issue that caused the SDK to stop producing logs in certain cases.

Version 5.40.1 - 2025-Sep-22

Fixed (Standard mode only)

• Fixed an issue where end-to-end encryption (E2EE) was not applied, causing requests to be sent unencrypted. This issue was introduced in 5.40.0.

Version 5.40.0; core-light 3.0.4; nfc 1.4.4; video-streaming 1.6.0; extensions 1.2.1; model-face-recognition 3.5.1; model-id-face-detection 3.5.1; model-liveness-detection 3.2.1 - 2025-Sep-05

Added (ALL modes)

• Introduced CommonConfig#setUXConfig() method for UX customizations in V2 IdScan and SelfieScan modules.

Added (STANDARD mode only)

• Added support for the onlyFront and onlyBack flags from the dashboard configuration for the IdScan module.
• Added customization guide for the Manual Shutter Button in the Selfie V2 module. Please refer to the SDK Customization How-To Guide for details.
• Added "All photos are encrypted" notice to IdScan v2.
• Added support for 16KB page size devices to the video-streaming module. More info here. This update to video-streaming module requires minSdk 24 or higher. Please see Migration Guide for details.
• Added logging for video streaming events. This will help to identify sessions where the video streaming failed to start or an error occurred during the streaming process.
• Added support for the Face Authentication module that performs a selfie scan to authenticate the user.
• Added detailed info about SDK versions to the Sdk Info event on the Dashboard.

Fixed (ALL modes)

• UI Improvements in Selfie v2.
• UI Improvements in IdScan v2.
• Fixed an issue where the Light and Dark themes were not correctly applied to permission screens in the IdScan V2 module.
• Added new primitive color to improve theme customization. It applies to IdScan v2 buttons and icons.
• Fixed a compile-time issue when using Dynamic Feature Modules with minSdk set to 23 or lower. Reported exception message was: Default interface methods are only supported starting with Android N (--min-api 24): Lx/CameraInfo;getLensFacing()I.
• Improved StatSig configuration to ensure reliable feature gate splitting.
• Fixed an issue where the onError() callback in the DocumentScan module was not triggered when the user denied camera permission.
• Improved camera error handling, ensuring that onError() is called when the camera fails to start, instead of the app crashing.
• Added integrity checks for ML models based on checksums. This will prevent the app from crashing if the model files are corrupted or missing.
• Improved error handling when ML models cannot be loaded by making the error messages more specific.
• If the Face Detector and Face Quality models cannot be loaded for any reason, Selfie module will immediately fall back to Manual Capture mode.
• Fixed an issue where the QuantityKeyword class required by IncodeWelcome.setQuantityStrings() API was not exposed.
• Fixed a crash in the IdScan v2 module that could occur when tapping the Help button, if the host app was using a newer version of Jetpack Compose.
• Fixed a crash in the NFC Scan module that could occur on some devices.
• Fixed an issue in the IdScan module where the exit confirmation dialog did not appear when the user pressed the close button.
• Fixed an issue in the SelfieScan module where the back button did not finish the flow after exit confirmation.
• Fixed the module execution order in startFlow() API. It now follows the order specified by the backend.
• Added a prefix to default font resources' names to avoid conflicts with other 3rd party dependencies that contain the same fonts.

Fixed (STANDARD mode only)

• Fixed a race condition that could cause video streaming in Selfie module to fail. The fix ensures that the Selfie module begins processing only after video streaming session is fully created.
• Fixed an issue where the selfie photo would be uploaded to subsequent sessions when using Deepsight together with Session Recording.
• Fixed an issue in the SelfieScan module where the Deepsight Video Liveness configuration was not respected when using the sections API with the no-API-key approach.

Added dependencies

• com.jakewharton.retrofit:retrofit2-kotlinx-serialization-converter:1.0.0

Updated dependencies

• kotlinCompilerExtensionVersion 1.4.4 -> 1.5.4
• com.opentok.android:opentok-android-sdk:2.25.1 -> com.opentok.android:opentok-android-sdk:2.30.1
• org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.10 -> org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.20
• org.jetbrains.kotlin:kotlin-gradle-plugin:1.8.10 -> org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.20
• org.jetbrains.kotlin:kotlin-serialization:1.8.10 -> org.jetbrains.kotlin:kotlin-serialization:1.9.20
• androidx.compose.material3:material3:1.1.2 -> androidx.compose.material3:material3:1.3.2
• androidx.compose.ui:ui:1.4.4 -> androidx.compose.ui:ui:1.7.8
• androidx.compose.ui:ui-graphics:1.4.4 -> androidx.compose.ui:ui-graphics:1.7.8
• androidx.compose.ui:ui-test-manifest:1.4.4 -> androidx.compose.ui:ui-test-manifest:1.7.8
• androidx.compose.ui:ui-test-junit4:1.4.4 -> androidx.compose.ui:ui-test-junit4:1.7.8
• androidx.compose.ui:ui-tooling:1.6.5 -> androidx.compose.ui:ui-tooling:1.7.8
• androidx.room:room-runtime:2.5.1 -> androidx.room:room-runtime:2.6.1
• androidx.room:room-rxjava2:2.5.1 -> androidx.room:room-rxjava2:2.6.1
• androidx.room:room-compiler:2.5.1 -> androidx.room:room-compiler:2.6.1
• com.guardsquare:dexguard-gradle-plugin:9.8.15 -> com.guardsquare:dexguard-gradle-plugin:9.12.2
• com.guardsquare:dexguard-runtime:9.8.15 -> com.guardsquare:dexguard-runtime:9.12.2
• com.statsig:android-sdk:4.39.2 -> com.statsig:android-sdk:4.42.2

Removed dependencies

• androidx.compose.ui:ui-tooling-preview

Design Changes

Highlights

• Added corner cases screens (for ID Capture V2 and Face Capture V2).
• Updated permission dialog (web + bottom sheet native).

ID Capture V2

• Added Age verification screen.
• Added vertical and passport capture screens.
• Added “All photos are encrypted” message on all capturing/result screens.
• Updated Permission dialog screen design for Web.
• Updated Permission dialog screen design to a bottom sheet for native iOS and Android.
• Added Photo review screen.
• Removed “We protect your data, and it is only used for verification” from Learn more permission screen for native iOS and Android.
• Added No Internet connection screen.
• Added Document not accepted errors screens.
• Added Verification processing screen.
• Added “No attempts remaining” disclaimer to the error screens with exhausted attempts.
• Added Dark mode screens on Happy path.

Face Capture V2

• Removed the “Face is blurry” feedback screen.
• Added “Eyes closed” feedback screen.
• Added No Internet connection screen.
• Changed the icon on error screens that had attempts left for the orange warn one.
• Added a Continue button and “No attempts remaining” disclaimer to the error screens with exhausted attempts.
• Visibilized “Face not aligned” error screen.
• Added Dark mode screens on Happy path.