Use Praxa from Kotlin and Android

​

Prerequisites

• an authenticated application backend that owns the Praxa credential;
• a reviewed mobile session mechanism and an app-facing bounded API contract;
• a simulator or emulator plus at least one physical-device test plan;
• synthetic data and a persisted local request identifier for lifecycle recovery;
• an acceptance assertion that proves the Kotlin client calls only its application backend and recovers one logical request across lifecycle changes.

​

1. Add Ktor Client

dependencies {
    implementation("io.ktor:ktor-client-core:3.5.1")
    implementation("io.ktor:ktor-client-okhttp:3.5.1")
    implementation("io.ktor:ktor-client-content-negotiation:3.5.1")
    implementation("io.ktor:ktor-serialization-kotlinx-json:3.5.1")
}

​

2. Implement the app-facing client

import io.ktor.client.HttpClient
import io.ktor.client.call.body
import io.ktor.client.engine.okhttp.OkHttp
import io.ktor.client.plugins.HttpTimeout
import io.ktor.client.plugins.contentnegotiation.ContentNegotiation
import io.ktor.client.request.bearerAuth
import io.ktor.client.request.post
import io.ktor.client.request.setBody
import io.ktor.http.ContentType
import io.ktor.http.contentType
import io.ktor.serialization.kotlinx.json.json
import kotlinx.serialization.Serializable

@Serializable
data class TaskSubmission(val task: String, val requestId: String)

@Serializable
data class TaskRun(val runId: String, val status: String)

class PraxaBackendClient(
    private val applicationOrigin: String,
    private val applicationToken: suspend () -> String,
    private val http: HttpClient = HttpClient(OkHttp) {
        install(ContentNegotiation) { json() }
        install(HttpTimeout) { requestTimeoutMillis = 30_000 }
    },
) {
    suspend fun submitTask(task: String, requestId: String): TaskRun {
        require(task.isNotBlank() && task.length <= 16_000)
        return http.post("$applicationOrigin/api/tasks") {
            bearerAuth(applicationToken())
            contentType(ContentType.Application.Json)
            setBody(TaskSubmission(task, requestId))
        }.body()
    }

    fun close() = http.close()
}

​

3. Preserve request identity

val pending = repository.loadPending() ?: PendingTask(
    requestId = UUID.randomUUID().toString(),
    task = draft,
).also(repository::save)

val run = client.submitTask(pending.task, pending.requestId)
repository.markAdmitted(pending.requestId, run.runId)

​

4. Test with MockEngine

1. Only your application origin is called.
2. No Praxa or provider credential exists in request or bundle constants.
3. Same pending task reuses the request ID.
4. Invalid input makes no request.
5. 401, 409, 429, timeout, and malformed JSON map to recoverable states.
6. Coroutine cancellation stops the local call but preserves unknown outcome.
7. Logging sanitizes the Authorization header and body.

​

Troubleshooting

​

Best practices

• Reuse one HttpClient and close it with the application/service lifecycle.
• Use HTTPS and keep certificate validation enabled.
• Store application session material with the Android Keystore-backed design approved for your app.
• Keep task content out of analytics and crash reports.
• Model offline, unknown, admitted, running, failed, and completed states.
• Test process death, not only recomposition.

​

Optimize for production

• Debounce repeated UI actions while preserving the same logical request ID.
• Return small app-facing projections and paginate history instead of copying upstream payloads.
• Reconcile on foreground with one bounded read rather than restarting the operation.
• Measure device-to-backend latency, resume success, duplicate prevention, payload size, and energy impact.

​

Cleanup and next steps

1. Revoke disposable backend credentials and test application sessions.
2. Delete synthetic server records and clear test-only secure-storage entries.
3. Remove captured screenshots, logs, and crash reports containing synthetic payloads.
4. Record physical-device, background, and recovery checks separately from unit tests.

​

Frequently asked questions

​

What proves this tutorial works?

​

Can a browser, mobile app, or model prompt hold the credential?

​

How should an ambiguous mutation be retried?

​

What should we monitor after release?