> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getdesmo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Android Auth & Environments

> Configure your Desmo keys, environments, and base URLs for the Android SDK.

## Keys and environments in Desmo

Desmo uses API keys to identify **who** is sending data and **which environment** it belongs to.

At a high level:

* **Publishable keys** (start with `pk_`) are used by the Android and iOS SDKs in your apps.
* **Secret keys** (start with `sk_`) are used only by your backend and internal tools.

Each key is created for a specific **environment**:

* `sandbox` – for development and test traffic.
* `live` – for production deliveries.

Your Desmo dashboard is where you create and revoke keys; this page focuses on how they are used from Android.

## Configuring the Android SDK with a key

When you call `Desmo.setup`, you pass your **publishable key** and an environment:

```kotlin theme={null}
import io.getdesmo.tracesdk.Desmo
import io.getdesmo.tracesdk.config.DesmoEnvironment

Desmo.setup(
    context = applicationContext,
    apiKey = "pk_sandbox_XXXXXXXXXXXXXXXX",
    environment = DesmoEnvironment.SANDBOX
)
```

Rules enforced by the SDK:

* The key **must** start with `pk_`, otherwise `DesmoConfig` throws `DesmoClientError.InvalidApiKey` and setup will fail.
* The key is sent on every HTTP request in the `Desmo-Key` header:

```http theme={null}
Desmo-Key: pk_sandbox_XXXXXXXXXXXXXXXX
```

You should **never** embed secret (`sk_...`) keys in your app—those belong only on your backend.

## Choosing an environment

The `DesmoEnvironment` type controls **which Desmo backend** the SDK talks to:

```kotlin theme={null}
Desmo.setup(
    context = applicationContext,
    apiKey = "pk_sandbox_XXXXXXXXXXXXXXXX",
    environment = DesmoEnvironment.SANDBOX  // or DesmoEnvironment.LIVE
)
```

Today, both `SANDBOX` and `LIVE` point to `https://api.getdesmo.io`, but they are treated as separate environments in the control plane (keys, tenants, projects).

Recommended usage:

* Use `SANDBOX` during development and QA.
* Use `LIVE` in your production app.

If your team sets up dedicated staging or internal endpoints in the future, you can update the SDK to route those environments without changing your app code.

## Rotating and revoking keys

When you create or revoke keys in the dashboard:

* Existing apps using an old **publishable** key will continue to work **until you revoke that key**.
* Once revoked, requests using that key will start failing with authorization errors.

Rotation checklist:

1. Create a new publishable key for the environment you need.
2. Update your app configuration (or remote config) to use the new key.
3. Ship an app update and wait for adoption.
4. Revoke the old key once you are confident no important traffic is using it.

## Security guidelines

* Treat keys as **credentials**:
  * Do not commit real keys into public repos.
  * Prefer using Gradle properties, environment variables, or a remote config system to inject keys.
* Never log keys in production logs.
* Use separate keys for sandbox and live environments to avoid test data mixing with real deliveries.

With keys and environments configured, your Android app can safely send telemetry to the right tenant and environment. Next, set up logging and troubleshooting so you can see what the SDK is doing.

## Permissions recap

The SDK expects your app to grant **location** and **motion** permissions so sessions can be tied to real-world deliveries and capture motion telemetry.

Required permissions:

* `ACCESS_FINE_LOCATION` – for GPS location tracking
* `ACCESS_COARSE_LOCATION` – fallback for network-based location
* `ACTIVITY_RECOGNITION` – for motion sensors (Android 10+ / API 29+ only)

Declare these in your `AndroidManifest.xml`:

```xml theme={null}
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
<uses-permission android:name="android.permission.ACTIVITY_RECOGNITION" />
```

At runtime, use `Desmo.getRequiredPermissions()`, `Desmo.hasRequiredPermissions(context)`, and `Desmo.getMissingPermissions(context)` to check and request what's needed.

For a full, copy-pastable example, see the [Android SDK Quickstart](/essentials/android-quickstart).