AFCore
Library-stable configuration for AFCore initialization. Not a data class to preserve binary/source compatibility across releases.
When clientId and clientSecret are required
Both fields default to empty string ("") when not provided through the builder, and initialize() accepts that without complaint. Empty strings are coerced to null at the storage layer, so downstream "client credentials not set" guards behave consistently.
Which credentials each auth method needs:
| Auth method | clientId | clientSecret |
|---|---|---|
authenticateWithCredentials (username/password) | not required — login, refresh, and revoke all run through the mobileapi/authentication endpoints with the username/password and refresh token alone | not required |
signInOrCreateMember (external user id) | required | required |
authenticateWithTokens (host-injected) | required for /auth/refresh on 401 | not required — flow never calls /auth/token and logout()'s server-side revoke fails silently while local state still clears |
Members who enrolled through the Enrollment Web Portal authenticate with authenticateWithCredentials and are already provisioned — they need no client credentials at all, so the SDK can be initialized with just a baseUrl.
Consumers integrating only via authenticateWithTokens can ship without bundling clientSecret in the mobile app. They still need a clientId if they want the SDK to attempt /auth/refresh on 401 before emitting SessionState.SESSION_EXPIRED. With no clientId the SDK skips refresh entirely and emits SESSION_EXPIRED on the first 401, which is the right behavior when the host owns auth end-to-end.
Constructors
Types
Functions
Whether the in-memory GET response cache is enabled.
Maximum number of cached GET responses retained before LRU eviction.
Time-to-live for cached GET responses, in milliseconds.
Connection-establishment timeout for SDK HTTP requests, in milliseconds.
Whether HTTP request/response logs are emitted. Independent of enableLogging.
How many days back the SDK probes for health data when establishing step/permission state. Apple platforms only — Android (Health Connect) uses its own aggregate query window and ignores this value.
Minimum spacing between background (geofence-triggered) heartbeats, in milliseconds.
Whether the location-tracking heartbeat is enabled for this install.
Minimum spacing between foreground-triggered heartbeats, in milliseconds.
Minimum severity for HTTP request/response logs. Independent of logLevel.
Number of automatic retries for transient failures (5xx responses and network I/O errors) on idempotent GET requests. 0 disables retries.
Target cadence for the periodic background outbox flush, in milliseconds. On Android this drives the WorkManager periodic interval; on iOS it is a lower-bound hint for the opportunistic BGTaskScheduler window.
Maximum age of an offline outbox event before it is discarded, in milliseconds.
Maximum number of offline events retained in the outbox before the oldest are dropped.
End-to-end request timeout (including refresh/retry) for SDK HTTP requests, in milliseconds.
Target cadence for periodic SmartWalking step sync, in milliseconds. Android only — on iOS, SmartWalking sync is HealthKit-observer driven and this value is ignored.
Per-socket read/write inactivity timeout for SDK HTTP requests, in milliseconds.
Whether manually-entered step samples should be included in step / activity aggregates. Defaults to false — the SDK only counts automatically-tracked data so a member can't inflate their totals by typing steps into the Health app.
How long before an access token's expiry the SDK proactively refreshes it, in milliseconds. Larger values refresh earlier (more resilient to going offline near expiry); smaller values squeeze more life out of each token.