Releasing our newly rewritten Android SDK

Ifedapo Olarewaju

Developer · Lagos, Nigeria · Show bio

In April 2018, we introduced a rewritten Android SDK⁠. Although our Java SDK⁠ could already be used in Android projects, and an earlier Android integration existed, the rewrite offered an API more consistent with the rest of our SDKs.

Built on the Java SDK, the Android integration added asynchronous Assembly submission and pause-and-resume support for uploads. An app could keep responding to the user while files were uploaded and processed, and receive progress and completion callbacks along the way.

Security update, September 2026: The original 0.0.2 example passed an Auth Secret to the SDK inside an Android activity. That would distribute the secret with the app. The executable activity examples have been replaced below; keep the Auth Secret on a trusted backend, even for an app distributed internally. The backend must authenticate the user and authorize the upload before signing any parameters. Follow our Signature Authentication guide and require signatures for the Workspace or Template used by the app.

The 0.0.2 Android client did not expose a SignatureProvider constructor. Keeping that release’s secret-based activity code and merely adding a backend URL would not fix it; an integration needs a supported external-signing API or a different request path.

The release originally used the Gradle compile configuration and listed Maven Central and JCenter as installation sources. Those were the installation instructions for 0.0.2, not a current build configuration. Its background workflow was:

1. Implement an Assembly listener to receive upload progress, upload completion, processing completion, upload failures, and status-update failures.
2. Create the Android client and an asynchronous Assembly associated with the activity’s context and listener.
3. Attach a local image and add a /image/resize Step, with a width and height of 75 pixels and resize_strategy set to pad.
4. Submit the Assembly and continue other work while the listener reports its progress. Upload completion and successful processing are separate events.

The old sample mixed androidAsyncAssembly and assembly variable names and is not a usable activity to copy into a current project. The following smaller example preserves the resize operation and shows the later signing boundary, without depending on an activity’s lifecycle.

It uses Android SDK 0.2.0 with Java SDK 2.2.4, both published on Maven Central. These are later versions, not the versions announced in 2018. The Android artifact’s published POM omits its dependency declarations, so do not assume that adding the AAR alone installs its dependencies. For a full Android integration, use the dependency list in the tagged Android build⁠ and verify it in your app’s build.

This helper accepts a SignatureProvider implemented by your existing backend integration. It contains neither a secret nor a signing endpoint:

import com.transloadit.android.sdk.AndroidTransloadit;
import com.transloadit.sdk.Assembly;
import com.transloadit.sdk.SignatureProvider;
import java.io.File;
import java.util.HashMap;
import java.util.Map;

public final class ImageUpload {
  private ImageUpload() {}

  public static AndroidTransloadit createClient(
      String authKey, SignatureProvider approvedSignatures) {
    return new AndroidTransloadit(authKey, approvedSignatures);
  }

  public static void addImage(Assembly assembly, File image) {
    assembly.addFile(image, "image");

    Map<String, Object> stepOptions = new HashMap<>();
    stepOptions.put("width", 75);
    stepOptions.put("height", 75);
    stepOptions.put("resize_strategy", "pad");
    assembly.addStep("resize", "/image/resize", stepOptions);
  }
}

The provider receives serialized parameters and returns the backend’s signature for those exact bytes, or throws if authorization or signing fails. Your server must enforce the allowed Steps or Template, destinations, file limits, and a short expiry. It must not sign an arbitrary JSON body just because the caller is logged in. For a fixed workflow, a server-selected Template with allow_steps_override disabled can keep the processing instructions under server control. Do not send the Auth Secret back to the provider.

In an Android app, the later API creates an AndroidAssembly with newAssembly(listener, context), where the listener implements AndroidAssemblyListener. That Assembly can be passed to ImageUpload.addImage, then submitted with saveAsync(). The progress callback is named onUploadProgress. Keep network work off the UI thread and bind callbacks to the app’s actual lifecycle. Inspect response status and hasError() as well as handling exceptions; an API error response is not necessarily thrown as an exception. The helper above covers client setup and image configuration; it does not implement background scheduling or verify pause-and-resume behavior on a device.

For details of the version you integrate, consult the Android SDK source⁠ and its API reference⁠. The original release made Android uploads easier to integrate; keeping signing on your backend is essential when carrying that workflow into an app today.