Android Secure Fields
Collect card data inside a native Android application without your code ever touching raw card values. The SDK renders secure input fields, validates the data, tokenizes it against the Purse gateway, and returns an opaque vault_form_token to your app.
How it works
Your backend uses the vault_form_token to create a payment via the Payment API — raw card data never passes through your servers or application code. This is the native Android counterpart of the web SecureFields flow; the server-side payment steps are identical.
Key characteristics
| Aspect | Detail |
|---|---|
| Card data isolation | Field values are held inside the SDK module. No public API returns a PAN, CVV, or expiry date. |
| What your app receives | Field validity, character count, detected brand, BIN prefix, last four digits, and the vault_form_token. |
| UI frameworks | Jetpack Compose (VaultForm for the whole form, or VaultField per field for custom layouts) and the View system (VaultFieldView in XML) |
| Environments | SANDBOX and PRODUCTION — the SDK resolves the correct endpoint |
| Distribution | Maven Central (eu.purse:securefields-android) |
Requirements
| Requirement | Value |
|---|---|
| Minimum Android SDK | 26 (Android 8.0) |
| Target / Compile SDK | 36 |
| Kotlin | 2.x |
| Java source compatibility | 11 |
| Internet permission | Required in your app manifest |
When to use this SDK
| Scenario | Recommendation |
|---|---|
| Building a native Android checkout | ✅ Android Secure Fields |
| Building a web checkout with the same server-side control | Web SecureFields (Advanced Flow) |
| Building a hybrid or fully web checkout | Consider Drop-in Checkout or Headless Checkout |
| CVV-only re-auth for a stored card | ✅ Android Secure Fields (CVV field only) |
| Fully outsourcing the checkout UI | Consider Hosted Page |
PCI DSS scope
The SDK architecture is designed to support SAQ A eligibility: card data is captured and tokenized by the SDK without your application code accessing the raw values. Formal scope determination requires assessment by a qualified security assessor (QSA). See Security and compliance for merchant obligations.
Known limitations
- Purse 3-D Secure is not supported yet. This SDK tokenizes the card only: it collects no 3-D Secure browser data and renders no challenge, unlike the Web SDK and its
threeDSChallenge. With the PSP's own 3-D Secure, the SDK has nothing to do: your backend gets aredirectionobject in the create payment response and redirects the shopper.