Install and integrate

Kylok is a pair of libraries: a Go SDK for your server and an Android Device Policy Controller (DPC) library for your device app. Use matching Go and Android versions. Your applications own business authorization, server lifecycle, Android application ID and signing.

Obtain packages

Choose the current package versions from GitHub Releases. The Go module is public, and the Android library is available from Maven Central; neither requires read credentials. Keep both SDKs on the same version/source revision.

Go host

Add the Go SDK to your server module:

go get github.com/thienvu18/kylok/go@v0.1.0-dev.40316176224

Inspect the signed Android host APK, create the SDK and mount its handler on your server:

apk, err := provisioning.Inspect(ctx, signedHostAPK, provisioning.Tools{})
// Handle err before constructing the SDK.
sdk, err := kylok.New(ctx, kylok.Options{
    PublicURL: "https://mdm.example.com",
    Bootstrap: apk,
    DataDir: "/var/lib/kylok",
})
// Handle err. Mount sdk.Handler() on your HTTP server.

Your server controls authorization, listening addresses and shutdown. The Android client uses HTTP/2 gRPC: enable HTTP/2 on the listener; if you use HTTP, enable h2c as well. A listener that only supports HTTP/1 cannot serve the Android SDK.

Use the Go APIs to create QR enrollments, list or revoke devices, register and assign APKs, review installation operations, and set or inspect policies. SQLite and filesystem storage are included. Use the ports interfaces if your product needs custom storage.

Android host

Add Maven Central and the Kylok dependency to your Android app:

repositories {
    google()
    mavenCentral()
}
dependencies {
    implementation("io.github.thienvu18.kylok:kylok-dpc:0.1.0-dev.40316176224")
}

Use JDK 17, min SDK 33, compile/target SDK 37 and a compatible Kotlin 2.2 compiler. Your app owns its application ID, signing key, network trust and backup policy. Keep the provisioning components and backup exclusions supplied by the library. Only Android's provisioning flow can grant Device Owner.

Read device status or schedule a sync from your app:

val registration = Kylok.observe(StatusListener { status -> render(status) })
Kylok.snapshot(context) { status -> render(status) }
// Close registration with your app lifecycle.
Kylok.retry(context) // schedules sync; read the result separately

Open Kylok.confirmPendingInstall only after a user action when Android requests install confirmation. Status callbacks are read-only notifications; they cannot approve policies or bypass authentication. See the API reference and example flows.

The current source also provides host integration and Android app configuration APIs.

Managed network permissions and secrets

Network lifecycle is optional. Hosts grant precise location and Nearby Wi-Fi devices runtime permissions, keep an independently reachable saved recovery SSID, and provide immutable scoped secret references through Options.NetworkSecrets for protected Wi-Fi. The example Android dashboard prompts only when a network policy is assigned. The trusted local CLI supports set-network/network, fleet operations and one-shot commands. See network lifecycle and CLI commands. These paths have software tests and require physical qualification.