Add to a project Pixelnetica™ Document Scanning SDK for Android

The SDK is distributed as Maven artifacts. There are two repositories to choose from, and the recommended one needs no account and no token. The demo application source code is a working project already set up this way — a useful reference while you follow the steps below.

1. Recommended: specify the repository in the project

Add the Pixelnetica repository to the project-level Gradle script. It is anonymous: no credentials, no account, nothing to request.

   repositories {
     maven {
       // Pixelnetica Document Scanning SDK
       url = uri("https://maven.pixelnetica.com/")
     }
   }

That is the whole prerequisite. If you are migrating from the GitHub Packages route, you can delete the token and the credentials block along with it.

2. Choose the modules and add the dependencies

The SDK is split into modules, so an application adds only what it uses:

A fourth artifact, support, is a utility library the modules above depend on; Gradle resolves it automatically, and you do not add it yourself.

For the minimal setup, add scanning to the “dependencies” section of the module-level build.gradle.kts file:

   dependencies {
       implementation("com.pixelnetica.sdk:scanning:3.2.0")
       .....
   }

Dependencies can also be managed through a Version Catalog:

• Add the following information to the gradle/libs.versions.toml file.

  [versions]
  .....
  pixelnetica="3.2.0"
  
  [libraries]
  .....
  pixelnetica-camera = { module = "com.pixelnetica.sdk:camera", version.ref = "pixelnetica"}
  pixelnetica-design = { module = "com.pixelnetica.sdk:design", version.ref = "pixelnetica"}
  pixelnetica-scanning = { module = "com.pixelnetica.sdk:scanning", version.ref = "pixelnetica"}
  

• Update the build.gradle.kts module file adding the following information.

  dependencies {
    .....
    implementation(libs.pixelnetica.scanning)
    implementation(libs.pixelnetica.design)
    implementation(libs.pixelnetica.camera)
  }
  

3. Which versions are where

https://maven.pixelnetica.com/ serves 3.0.0, 3.0.1, 3.1.1, 3.1.2 and 3.1.3, and every release from 3.2.0 onwards.

Two exceptions are worth stating plainly rather than leaving you to discover them:

• 3.1.0 is not there. It was only ever published for support, so it was never a resolvable set, and it stays where it is.
• -SNAPSHOT versions are not there either. They remain on GitHub Packages.

Everything ever published to GitHub Packages stays on GitHub Packages and is never removed, so a project pinned to any of it keeps working. The 2.x series remains at its own legacy host and is unaffected by any of this.

4. Verifying the artifacts

Every file published from 3.2.0 onwards is signed, and carries .md5, .sha1, .sha256 and .sha512 checksums alongside the signature.

The public key is at https://maven.pixelnetica.com/KEYS. Its fingerprint is:

59C6 C9B1 371D F73B E3E3  D278 EB30 ADAA ED5B 88C0

To check a downloaded file by hand:

curl -O https://maven.pixelnetica.com/KEYS
gpg --import KEYS
gpg --verify scanning-3.1.3.aar.asc scanning-3.1.3.aar

If you use Gradle’s dependency verification with verify-signatures, the same key is published on keys.openpgp.org. Add it to your gradle/verification-metadata.xml so Gradle knows where to look:

<key-servers>
   <key-server uri="https://keys.openpgp.org"/>
</key-servers>

Gradle queries a set of well-known key servers by default, and this key is on more than one of them — but which servers Gradle consults is a Gradle detail that can change, so naming the server in your own configuration is the reliable form rather than relying on the default.

5. The GitHub Packages route: still supported and sunsetting

This route needs a GitHub account and an access token. GitHub requires authentication for every Maven package download — even for public packages like ours. This is GitHub’s platform rule, not a Pixelnetica restriction: any GitHub account can download the SDK, there is nothing to request from us, and the token does no more than tell GitHub who is downloading.

Create the token in GitHub under Settings → Developer settings → Personal access tokens → Tokens (classic) → Generate new token (classic), and grant it the read:packages scope only — it needs no repository access and no other permissions. GitHub’s token documentation covers managing and revoking tokens.

Two more things worth deciding when you create it:

• Expiration. GitHub suggests an expiry date; when it passes, dependency resolution stops with a 401 that looks like a configuration mistake (see Troubleshooting). Pick a date you will remember — or note where the token is used so the renewal is a one-line change.
• Storage. Treat the token like a password: keep it in local.properties (as the demo application does) or in ~/.gradle/gradle.properties, never in a file you commit. On a build server, use the CI system’s secret store.

Then declare the repository, supplying the credentials from local.properties so they stay out of version control:

   repositories {
     maven {
       // Reference to Scanning SDK library
       url = uri("https://maven.pkg.github.com/Pixelnetica/artifacts")
       credentials {
         username = "<YOUR GITHUB USER NAME>"
         password = "<YOUR GITHUB TOKEN>"
       }
     } 
   }

The module dependencies are the same either way — section 2 above applies unchanged.

Please use the most recent DSSDK version if you have an active SMUA (Support Maintenance and Upgrade Assurance) or active Standard subscription. If you are not sure, feel free to contact Pixelnetica DSSDK Support. Take into consideration that from time to time DSSDK can be changed.

6. Third-party notices

Each SDK library bundles assets/third-party-notices.txt, listing the open-source components inside the SDK and reproducing the licence text each one requires. Android merges library assets into your app, so the file is already in your APK once you depend on the SDK — you do not need to copy it anywhere. Most of those licences ask that their notice reach the people who receive the software, which for a mobile app usually means an acknowledgements or open-source-licences screen; reading the file out of your assets is the simplest way to fill one.

The OCR language packs are distributed separately from the SDK artifacts and carry their own notice inside that download.

For more details please check:

• Document scanning SDK page,
• DSSDK Version History,
• Documentation,
• demo application source code.