Certificall Mobile SDK

The mobile SDK lets you capture photos and have them certified from your own iOS or Android application. Each photo sent to Certificall produces a closed case and its PDF certificate.

The workflow uses two methods:

takePhoto() opens the camera and returns the photo with the trust data collected at capture time. Nothing is uploaded.
sendPhoto() sends that capture to Certificall and returns the case and photo identifiers, along with links to the image and certificate.

Between these calls, your application keeps the capture and decides when to send it. You can send it immediately or keep it for a deferred upload, for example when connectivity returns.

Choose your integration

Application	Guide
React Native	React Native integration
Capacitor 7	Capacitor integration
iOS with Swift or Android with Kotlin	Native integration
Parameters, results, storage and errors	SDK reference

The React Native and Capacitor bridges expose the same native SDK on iOS and Android. Photo capture and upload require a native application: they are not available in a browser.

Expo

With Expo, use a development build and expo prebuild. Expo Go cannot load this native module.

Obtain the SDK

Your Certificall contact provides a delivery archive containing the components for your application:

certificall-mobile-sdk-react-native-<version>.tgz for React Native;
certificall-mobile-sdk-capacitor-<version>.tgz for Capacitor;
CertificallTrust.xcframework and/or certificall-trust-sdk.aar for native integration;
the integration guide and a SHA256SUMS checksum file.

The .tgz packages contain the required native binaries. Installation is described in your framework's guide. You do not need access to a source repository or a private npm registry.

To check a checksum provided by Certificall:

shasum -a 256 vendor/certificall-mobile-sdk-react-native-<version>.tgz

SDK API key

The SDK uses an SDK API key provided by Certificall and associated with your company. Created cases appear in that company's workspace.

Property	Value
Format	`cer_sdk_<company identifier>_<random value>`
Delivery	The key is displayed only once, when it is created.
Validity	One year by default; Certificall can disable or renew it.
Request limit	1,000 requests per hour per key; further uploads receive HTTP status `429`.

The SDK key is separate from the token used for the REST API. The SDK uses it during upload; you do not need to build authentication headers.

Plan for renewal

Provide a way to update the key in your application, for example through remote configuration. Renewal disables your company's previous keys.

Environments

Set the environment explicitly with baseUrl, including the /certificall/ suffix and its trailing /:

Environment	`baseUrl`
Production	`https://admin.certificall.app/certificall/`
Pre-production	`https://dev.certificall.app/certificall/`

Pre-production lets you send photos taken with a development build. Use the key provided for the relevant environment.

An incorrect URL can cause SERVER_REJECTED, even when the server returns an HTML page with status 200. Keep the capture, correct the configuration, then send it again.

Photo workflow

Your application
  ├─ Permissions and SDK configuration
  ├─ takePhoto() → local capture and trust data
  ├─ Save the capture in your storage
  └─ sendPhoto() → Certificall
                       ├─ Create and close the case
                       ├─ PDF certificate and sendPhoto() response
                       ├─ Case webhook, if configured
                       └─ Trust analysis → result webhook, if configured

Request permissions for your platform, then configure the SDK.
Call takePhoto() from your capture screen. You can provide your business reference (reportToken) and metadata.
Save the returned object in full, including its image, in your storage if the upload must survive the application being closed.
Call sendPhoto() right after the capture, as soon as the network allows. A photo uploaded more than 10 minutes after it was taken carries the "no internet connection" banner on its certificate.
After a successful upload, use caseId, itemId, imageUrl and pdfUrl, and review any warnings.
Retrieve the trust score through the analysis result webhook. The score is not a field in the sendPhoto() response.

The case webhook delivers the case content when it closes. The two webhooks are independent and configured for your company.

One photo per case

The SDK uses the photo frame set up for your company. Each new capture you send creates its own case; sending the same already-certified capture again returns that same case. For a multi-step workflow, see the API and Certilinks.

Trust data and device checks

The SDK collects positions, motion, device information and network information. These data are frozen at capture time: a deferred upload does not replace them with data from upload time.

Photos come exclusively from the camera. On Android, the SDK uses a pre-installed camera application and passes the image through your application's private cache, which is cleaned up when capture ends. On iOS, capture is processed in memory. The SDK does not offer the photo library.

In a distribution build, capture is refused in the following situations:

Reason	Situation
`emulator_detected`	The device is an emulator.
`developer_mode_enabled`	Device developer mode is detected.
`low_battery`	Battery is below 10% and the device is not charging.

These refusals use the DEVICE_NOT_TRUSTED code. No configuration option disables these checks.

Missing trust data, such as a GPS position, are reported at upload time as a warning. They can reduce the trust score without being, on their own, a reason to reject the photo.

Initialize before capture

Once permissions have been granted, configure the SDK when the relevant screen opens. This gives sensors time to collect a history before the photo is taken.

Test with a development build

The SDK detects your application's build type:

Android: the build is a development build if the application is debuggable.
iOS: the simulator and applications signed for development are recognized as development builds. App Store, TestFlight and ad hoc distributions apply device checks.

In a development build, device checks are relaxed and the capture carries debugBuild: true. The iOS simulator offers a test image without using the photo library.

Development photos

Photos marked debugBuild: true are accepted in pre-production and rejected in production, even if they are later uploaded from a distribution build. For production, take a new photo from a distribution build.

Use isDebugBuild() to check the build type. The result is a boolean with React Native and native SDKs, and an object { debugBuild: boolean } with Capacitor.

Choose your integration​

Obtain the SDK​

SDK API key​

Environments​

Photo workflow​

Trust data and device checks​

Test with a development build​