Protect the connection.
Bind the device key.

// app/build.gradle.kts — use each module’s published version.
implementation("io.github.jimmyleonardo:aegis-guardian:3.2.0")
implementation("io.github.jimmyleonardo:aegis-guardian-okhttp:1.2.0")

// Network service: reuse the Guardian configured by your Application.
import com.jimmyleonardo.guardian.AegisGuardian
import com.jimmyleonardo.guardian.network.enableAegisPinning
import com.jimmyleonardo.guardian.network.attachAegis
import okhttp3.OkHttpClient

fun makePinnedClient(
    guardian: AegisGuardian,
    activePin: String,
    backupPin: String
): OkHttpClient {
    require(activePin != backupPin) { "Use a distinct backup key pin" }
    return OkHttpClient.Builder()
        .enableAegisPinning("api.example.com", activePin, backupPin)
        .attachAegis(guardian)
        .build()
}

// Supply real sha256/<Base64 SPKI digest> pins for your own HTTPS API.
// Retain and use the returned client for the requests you intend to pin.
// Handle setup errors; never silently substitute an unpinned client.
// Run requests via enqueue(), or execute() on a worker thread.

# Use a certificate obtained through a trusted channel.
openssl x509 -in server.pem -pubkey -noout |
  openssl pkey -pubin -outform DER |
  openssl dgst -sha256 -binary |
  openssl base64 -A

# Prefix the output with sha256/.
# Repeat with a DIFFERENT backup public key's certificate before rotation.

// On a worker thread, using your Application's shared guardian:
val deviceId = guardian.getDeviceId()

// This is a best-effort app identifier, not an authentication credential.
// Handle failures and avoid putting identifiers in unrestricted logs.

import com.jimmyleonardo.guardian.AegisGuardian

// Enrollment operation, on a worker thread, with a fresh backend challenge.
fun enrollDeviceKey(
    guardian: AegisGuardian,
    challenge: ByteArray
): Result<List<ByteArray>> {
    require(challenge.size in 1..128)
    return guardian.createDeviceKeySafely(challenge)
}

// Separate operation after the backend has accepted the enrollment.
fun signBackendChallenge(
    guardian: AegisGuardian,
    serverBoundMessage: ByteArray
): Result<ByteArray> = guardian.signWithDeviceKeySafely(serverBoundMessage)

// Enrollment returns a leaf-first DER certificate chain.
// Signing returns an ECDSA P-256/SHA-256 signature in ASN.1 DER.
// Creating a device key replaces the existing key. Do not do it each launch.

import android.view.MotionEvent
import com.jimmyleonardo.guardian.ui.enableAegisTapjackingProtection
import com.jimmyleonardo.guardian.ui.isAegisTouchTrusted

// On the UI thread, on the View handling your sensitive action:
val protection = sensitiveView.enableAegisTapjackingProtection()
if (protection.isFailure) {
    sensitiveView.isEnabled = false
}

// In your Activity: also reject partially obscured touches on API 29+.
override fun dispatchTouchEvent(event: MotionEvent): Boolean {
    if (!event.isAegisTouchTrusted()) return true
    return super.dispatchTouchEvent(event)
}

// sensitiveView is your actual View; the helper does not replace listeners.

import com.jimmyleonardo.guardian.crypto.wipe

val temporaryBytes = byteArrayOf(1, 2, 3)
try {
    // Use the owned buffer for your operation.
} finally {
    temporaryBytes.wipe()
}

// CharArray.wipe() is available too.
// This is best-effort; JVM/provider copies may still exist.

// app/build.gradle.kts — optional Android integrations:
implementation("io.github.jimmyleonardo:aegis-guardian-integrity:3.2.0")
implementation("io.github.jimmyleonardo:aegis-guardian-gateway:1.2.0")

// Add only modules you integrate. Installation alone activates nothing.
// Integrity needs your app's Google Play / Cloud configuration and backend.
// Gateway needs device enrollment and a matching HTTPS backend.