Token Binding (Driver Layer)#

let tokenBoundConfiguration = BoundedTokenConfiguration(
    keyPairType: CryptoKeyType.secureEnclave
)

let haapiTokenManager = HaapiTokenManagerBuilder(
    tokenEndpoint: tokenEndpoint,
    clientId: clientId
)
.setTokenBoundConfiguration(config: tokenBoundConfiguration)
.build()

Use CryptoKeyType.secureEnclave when available; fall back to CryptoKeyType.p256 (software-backed) when Secure Enclave is not viable — some boot-state scenarios make the Secure Enclave key inaccessible.

val tokenBoundConfiguration = TokenBoundConfiguration(
    keyAlias = "token-bound-key",
    keyPairAlgorithmConfig = KeyPairAlgorithmConfig.ES256,
    storage = mySharedPrefsStorage,
    currentTimeMillisProvider = { System.currentTimeMillis() }
)

val haapiTokenManager = HaapiTokenManager.Builder(
    clientId = clientId,
    tokenEndpointUri = tokenEndpointUri
)
.setTokenBoundConfiguration(tokenBoundConfiguration)
.build()

The storage parameter is mandatory — supply a Storage implementation that persists key state across processes. The Android Keystore alone is not reliable enough for long-lived state.