Tap-to-pay
without hardware.

class PaymentHceService : HostApduService() {

    companion object {
        private val SELECT_APDU_HEADER = byteArrayOf(
            0x00.toByte(), 0xA4.toByte(),
            0x04.toByte(), 0x00.toByte()
        )
        private val SW_OK = byteArrayOf(0x90.toByte(), 0x00.toByte())
        private val SW_UNKNOWN = byteArrayOf(0x6F.toByte(), 0x00.toByte())
        private val SW_NOT_FOUND = byteArrayOf(0x6A.toByte(), 0x82.toByte())
    }

    override fun processCommandApdu(
        commandApdu: ByteArray,
        extras: Bundle?
    ): ByteArray {
        return try {
            when {
                isSelect(commandApdu) -> handleSelect(commandApdu)
                isGpo(commandApdu)    -> handleGpo(commandApdu)
                isReadRecord(commandApdu) -> handleReadRecord(commandApdu)
                isGenerateAc(commandApdu) -> handleGenerateAc(commandApdu)
                else -> SW_NOT_FOUND
            }
        } catch (e: Exception) {
            // Never let an exception crash the tap
            SW_UNKNOWN
        }
    }

    override fun onDeactivated(reason: Int) {
        // Clean up session state. reason is either
        // DEACTIVATION_LINK_LOSS or DEACTIVATION_DESELECTED
    }

    private fun isSelect(apdu: ByteArray): Boolean =
        apdu.size >= 4 &&
        apdu[0] == 0x00.toByte() &&
        apdu[1] == 0xA4.toByte()

    // ... isGpo, isReadRecord, isGenerateAc follow the same pattern
    // checking CLA + INS bytes against EMV spec values
}

<!-- res/xml/apduservice.xml -->
<host-apdu-service
    xmlns:android="http://schemas.android.com/apk/res/android"
    android:description="@string/hce_service_description"
    android:requireDeviceUnlock="true">

    <aid-group
        android:category="payment"
        android:description="@string/aid_group_description">
        <!-- Visa AID — requires scheme licence -->
        <aid-filter android:name="A0000000031010" />
        <!-- Mastercard AID — requires scheme licence -->
        <aid-filter android:name="A0000000041010" />
    </aid-group>

</host-apdu-service>

private fun generatePaymentKey(alias: String): SecretKey {
    val keyGen = KeyGenerator.getInstance(
        KeyProperties.KEY_ALGORITHM_AES,
        "AndroidKeyStore"
    )

    val specBuilder = KeyGenParameterSpec.Builder(
        alias,
        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
    )
        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
        .setKeySize(256)
        .setUserAuthenticationRequired(true)
        .setInvalidatedByBiometricEnrollment(true)
        .setUnlockedDeviceRequired(true)

    // StrongBox with TEE fallback
    try {
        specBuilder.setIsStrongBoxBacked(true)
        keyGen.init(specBuilder.build())
        return keyGen.generateKey()
    } catch (e: StrongBoxUnavailableException) {
        // Fall back to TEE — still hardware-backed, just not StrongBox
        val teeSpec = KeyGenParameterSpec.Builder(
            alias,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setKeySize(256)
            .setUserAuthenticationRequired(true)
            .setInvalidatedByBiometricEnrollment(true)
            .setUnlockedDeviceRequired(true)
            .build()
        keyGen.init(teeSpec)
        return keyGen.generateKey()
    }
}