Android SDK

How it works

1. When the user taps your Earn button, your app asks your own server for a session.
2. Your server calls POST /v1/session with your API key and the user’s ID, and passes the token to the app.
3. The app calls Sharklio.open(activity, token). The SDK opens the offerwall in a native screen.
4. Rewards reach your server through your postback, exactly as with the offerwall link. See Postbacks.

A token works once and for 10 minutes. Create a new one each time the user opens the offerwall. Your API key and your link hash salt stay on your server, so nothing in your app can be used to open another user’s offerwall.

Install

Android 5.0 (API 21) or newer. The SDK has no third-party dependencies. Add the Sharklio Maven repository and the dependency:

// settings.gradle.kts
dependencyResolutionManagement {
    repositories {
        google()
        mavenCentral()
        maven { url = uri("https://sharklio.com/maven") }
    }
}

// app/build.gradle.kts
dependencies {
    implementation("com.sharklio:offerwall:1.1.0")
}

The SDK brings its own R8 and ProGuard rules, so you do not need to add any.

Create a session on your server

Send the fields as a form or as JSON, with your API key in the Authorization header. You find the key under Apps, your app, Integration.

Field	Description
user_idrequiredstring	The same user ID you receive in postbacks. 1 to 100 characters: letters, numbers, and . _ @ : + -.
sub1 to sub5optionalstring	Your own tracking values. They are returned in the postback as {sub1} to {sub5}.

Status	error	Meaning
201		The session was created. Pass token to your app.
400	invalid_user_id	user_id is missing or has characters that are not allowed.
401	invalid_api_key	The API key is missing or wrong.
403	app_not_live, user_blocked	The app is paused, or this user is blocked. Do not show the offerwall.
405	method_not_allowed	Use POST.
429	rate_limited	More than 600 requests in a minute for this app. Retry after the time in the Retry-After header.

Open the offerwall

Call init once, for example in your Application class, with the App ID from the Integration tab. Then open the offerwall with the token from your server.

// Kotlin
Sharklio.init(applicationContext, "YOUR_APP_ID")
Sharklio.open(activity, token)

// your own title, see Branding below
Sharklio.open(activity, token, SharklioOptions(title = "Earn coins"))

// Java
Sharklio.init(getApplicationContext(), "YOUR_APP_ID");
Sharklio.open(activity, token);

Branding

The top bar of the offerwall screen shows the Sharklio mark, like the offerwall itself, with your offerwall title and colors from the Design tab of your dashboard, so it matches your offerwall without any code. When you change them in the dashboard, the SDK picks them up within a few minutes.

To set the title or color yourself, or to hide the mark, pass options. Anything you set wins over the Design tab:

Sharklio.open(activity, token, SharklioOptions(
    title = "Earn coins",
    toolbarColor = 0xFF004ABB.toInt(),
    showLogo = false,
))

Events

Sharklio.setListener(object : SharklioListener {
    override fun onOpened() { }
    override fun onClosed() { refreshBalance() }
    override fun onError(error: SharklioError) { Log.w("Earn", error.code.name) }
})

Event	When
onOpened	The offerwall finished loading.
onClosed	The user closed the offerwall. A good moment to load the user’s balance from your server.
onError	NOT_INITIALIZED, INVALID_APP_ID, INVALID_TOKEN, TOKEN_EXPIRED_OR_USED, NETWORK, or UNKNOWN. Create a new session and try again.

Set the listener from a long-lived object, such as your Application, or clear it with Sharklio.setListener(null) when your screen goes away.

What the SDK handles for you

• Offers that lead to Google Play open in the Play Store app, and other sites open in the browser, so installs are tracked correctly.
• The back button goes back inside the offerwall, and the close button returns to your app.
• Screen rotation and low-memory restarts keep the user where they were, without using the token again.
• A locked-down WebView: no file access, no mixed content, Safe Browsing on, and no JavaScript bridge into your app.

Security

• Create sessions on your server only. Never put the API key or the link hash salt in your app, because anyone can read an app’s files.
• Credit rewards only from the signed postback on your server, never from events in the app. Events can be faked on a user’s device.
• Make sure your own endpoint that returns tokens only does so for the signed-in user.

Testing

Before you launch, create a session from your server for a test user ID and open it in a debug build of your app. Check that the offerwall opens, that an offer opens in the Play Store or the browser, and that the back and close buttons work. Then send test postbacks from Integration status on the Integration tab of your app to check your server. Test on a normal home or mobile connection: on a VPN or a test device in the cloud, the offerwall shows a block page such as VPN detected instead of offers. See Testing.

Clicks that come through the SDK show as sdk in the {integration} postback macro and in the Reporting API, and as Mobile SDK in your dashboard.