Authentication

TrainingKit has two runtime authentication contracts, plus a build-time key used only for schema introspection. The contracts themselves are defined in the API section; this page shows how each one surfaces in the Android SDK.

The two runtime contracts

Contract	What it protects	How it travels	Required?
API Authentication	Your B2B API perimeter — only your authenticated backend context can call the API	A backend-issued JWT sent on your GraphQL requests	When enabled in your Admin Console (recommended for production)
SDK Authentication	TrainingKit integrity — blocks forged, modified, or replayed workout payloads	The X-TrainingKit-Device handshake that returns a TrainingKitToken, passed to the workout fragment	Always — it is mandatory to launch a workout

Full reference:

• API Authentication
• SDK Authentication

API Authentication (request JWT)

Your backend issues a short-lived JWT (signed with your RSA/ECDSA key, carrying a sub claim for the end user) and your app attaches it to every GraphQL request — typically an Authorization: Bearer <jwt> header. The API layer validates it; the SDK does not. This layer is turned on and configured (public keys, JWKS/PEM) by the B2B client in the Admin Console.

Add it to your GraphQL client, for example as an Apollo interceptor:

val request = chain.request().newBuilder()
    .addHeader("Authorization", "Bearer $backendJWT")
    .build()

Issue the JWT server-side and deliver it securely; never embed the signing key in the app.

SDK Authentication (device handshake + TrainingKitToken)

Launching a workout requires a device-bound token. Send the SDK device identifier on the session request, then pass the returned TrainingKitToken to the fragment.

1. Attach the device id to the publicWorkoutSession request:

   val deviceId = DeviceIdHelper.getDeviceId(context)
   request.addHeader("X-TrainingKit-Device", deviceId)

2. Read the TrainingKitToken from the response — GraphQL extensions.trainingkit.token, the trainingKitToken field on the session, or the X-TrainingKit-Token header.

3. Pass it (and the same deviceId) when you create the fragment:

   val fragment = GoFragment.newInstance(workoutContent, config, trainingKitToken, deviceId)
   // or WorkoutVideoFragment.newInstance(workoutContent, config, trainingKitToken, true)

If token validation fails, the SDK reports a JWTVerificationException and the workout does not start. The token is valid for one day and bound to the current app lifecycle, so fetch the session shortly before launch. See SDK Authentication for lifecycle, caching, and refresh rules.

Build-time only: X-Developer-Authorization-Key

This is not a runtime credential. It unlocks GraphQL schema introspection (for the Admin Console Playground or code generation, e.g. ./gradlew downloadServiceApolloSchemaFromIntrospection) and is retrieved from your Admin Console API settings.

Use it only on developer machines or CI. Never ship it in the app build or hard-code it in source that ends up in the APK.