We recommend updating to this version of the SDK for security enhancements.
Security
Updated OkHttp to 4.12.1 to address CVE-2026-111943. This protects the SDK’s network connections, including on devices without Google Play services.
Updated core security, code protection, and payment kernel dependencies.
New Features
Added support for JCB cards.
TransactionFailed.tapToPayException now includes the backend error details. PaymentException.ErrorAction has new acquiringErrorTextId and acquiringErrorDescription fields.
Preparation for Girocard support, rolling out in coming weeks.
Fixes
Fixed a crash (NoSuchMethodError) on the SDK’s first network request in host apps built with R8 obfuscation. This affected versions 1.1.5 and 1.1.6.
When the card type (credit/debit) doesn’t match, the cardholder can now re-tap up to 3 times, as intended, instead of once.
Fixed a crash when the PIN entry security library failed to load. The payment now fails with an error instead.
Improved reliability on devices that don’t deliver sensor events.
Fixed an out-of-memory issue caused by metrics recording.
Integration Notes
This release contains breaking API changes. Code that passes affiliateData = null or uses shouldDisplayReceipt no longer compiles.
CheckoutData.affiliateData is now required. Pass an AffiliateModel with your app’s affiliate key so transactions are attributed to your integration.
PaymentFlowClosedSuccessfully.shouldDisplayReceipt has been removed, as announced in 1.1.6. Remove any references to it.
The SDK’s consumer ProGuard rules no longer disable code shrinking (-dontshrink) or apply global keep rules to all enums and native methods in your app. If your release build relied on these, test it before shipping.
Redesigned the payment UI (success, error, warning, loading, and tap-card screens), including updated animations and PIN-pad styling.
When a presented card cannot be used, the SDK now prompts the cardholder to try another card instead of failing the payment immediately.
After repeated unsuccessful “try another card” attempts, the payment fails with PaymentException.CardErrorNotAccepted (code 1029).
Fixes
Fixed an issue that could send the charge request twice after a network interruption.
Fixed an issue where a transaction that had already failed on the backend might not notify the integrator with TransactionFailed.
Fixed a PIN-pad issue on some devices where digit 0 was not visible.
Integration Notes
The Send receipt button has been removed from the SDK success screen. Receipts must be handled by the host app if required.
PaymentFlowClosedSuccessfully.shouldDisplayReceipt is deprecated, always emitted as false, and will be removed in 1.1.7. Existing two-argument constructors still compile.
skipSuccessScreen is unchanged. Hosts that already show their own success UI are unaffected.
If you use an exhaustive when on PaymentException, add a branch for PaymentException.CardErrorNotAccepted.
Important — dependency and toolchain
The SDK is now built with Kotlin 2.2.21. Host apps compiling with Kotlin 1.9.x are likely to fail with a Kotlin metadata version mismatch. Upgrade the host Kotlin Gradle plugin to 2.0+ (2.2.x recommended) before integrating 1.1.6.
We recommend updating to this version of the SDK for security enhancements.
New Features
Added optional timeoutCardWaitSeconds to startPayment, allowing integrators to configure how long the SDK waits for card presentation.
The default card-wait timeout is now 240 seconds. Supported values are clamped between 60 and 240 seconds.
Updated SDK build support for Android 16 / API 36.
Updated core security, attestation, obfuscation, and payment kernel dependencies.
Fixes
Fixed an issue where rotating the device during an active transaction could interrupt the payment flow.
Fixed a recovery issue where transactions could keep failing with “Could not connect to the server” after a temporary network failure until the app was restarted.
Improved NFC card-read handling by retrying after supported L1 read errors.
Integration Notes
Existing integrations continue to work without code changes.
Integrators can optionally pass timeoutCardWaitSeconds when starting a payment to customize the card presentation timeout.
SumUpLoginContract, SumUpCardReaderPageContract, and SumUpCheckoutContract to support Activity Result API integrations. Existing onActivityResult-based integrations remain unchanged. Please refer to the documentation for more information.
Improvements:
Reduced SDK size by approximately 8 MB.
In offline sessions, totalApprovedAmount now includes tip amounts.
Important: SDK v7.1.0 introduces internal changes that are not backward compatible. After upgrading and running the application with v7.1.0, downgrading to an earlier SDK version is not supported.
Payment intent now also returns the card reader model and firmware version in new response fields SumUpAPI.Response.CARD_READER_MODEL and SumUpAPI.Response.CARD_READER_FIRMWARE_VERSION at the end of every transaction.
Improvements:
Renames package of TransactionInfo: com.sumup.merchant.reader.models.TransactionInfo > com.sumup.checkout.core.models.TransactionInfo
Renames package of SumUpState: import com.sumup.merchant.api.SumUpState > import com.sumup.reader.sdk.api.SumUpState
Miscellaneous bug fixes and enhancements.
Updates about the technical stack:
Minimum supported targetSDK is 35
Minimum Kotlin is upgraded to 1.9.0
Minimum Kotlin Coroutine is upgraded to 1.8.0
Minimum Hilt is upgraded to 2.51.1
Minimum Moshi is upgraded to 1.15.0
Minimum AppCompat is upgraded to 1.7.0
Minimum AndroidX Annotation is upgraded to version 1.8.0
Minimum AndroidX Activity is upgraded to version 1.9.1
Minimum AndroidX Fragment is upgraded to version 1.7.1
Minimum AndroidX Lifecycle is upgraded to version 2.8.1
Minimum AndroidX Browser is upgraded to version 1.4.0
Minimum AndroidX Navigation is upgraded to version 2.7.7
Minimum Material Components is upgraded to 1.12.0
Minimum Play Services Location is upgraded to 21.3.0- Minimum AGP is upgraded to 8.8.0
Added support of Online Pin SCA (Strong Customer Authentication).
Added card data to PaymentEvent.TransactionDone event: card type, card scheme, last four digits, and merchant code.
Transparent attestation process. The SDK now returns error details if attestation fails in PaymentEvent.TransactionFailed event. This helps developers understand and resolve attestation issues more effectively.
API changes to make it more concise. Now TapToPay.startPayment() function returns Flow<PaymentEvent> instead of Flow<Result<PaymentEvent>>.
Mitigated threats are now filtered out during attestation. If a threat has "mitigated": true, it is excluded from the threat list that is used to determine whether the COTS is attested.
The Solo card reader now supports connecting and transacting over USB cable. The minimum required Solo software version that supports the USB mode is 3.3.17.2.
If this version (3.3.17.2) is not yet available on your Solo when connected via Bluetooth, you can switch it to standalone mode (Menu -> Connection -> WiFi), login directly on the Solo, and update it to the latest version.
Solo USB is under beta phase which means that the feature still requires some optimization to ensure full stability.
Known limitations: currently, if the USB cable is unplugged, the USB permission on the mobile device will need to be regranted. As of now, Solo is not able to wake up automatically from sleep mode. A connection needs to be reestablished from