Local build rejects valid production cards

[MichaelTaylor3d]

Hi there! Thanks for maintaining this project.
I'm running into an issue when building the app from source. My Tangem card works perfectly with the official app downloaded from the Google Play Store, but when I build and run from source, I receive the following error:

"This card is a production sample or counterfeit"

I've reviewed the README but couldn't find any documentation on configuring the build to work with legitimate production cards.

Steps to reproduce:

Clone the repository
Build and install the app from Android Studio
Attempt to scan a valid Tangem card

Expected behavior: The app should recognize and work with valid production Tangem cards, similar to the Play Store version.

Actual behavior: The app displays an error stating the card is a "production sample or counterfeit."

Context: I have some coins on an EVM chain that isn't currently supported (Optimism Superchain). Tangem support mentioned it could be a while before official support is added, but suggested I could try building from source and adding the chain myself to recover my funds.

Question: Is there a configuration setting, build flag, or additional setup step required to enable support for production cards in local builds? Any guidance would be greatly appreciated.

Thanks in advance for your help!

[DontCopyThatFloppy]

If the community could easily add their own support for ETH-ecosystem tokens we'd spend a lot less time begging devs to add new coins. +1!

[MichaelTaylor3d]

Here is the setup:

Additionally Im a bit concerned, because I just saw on X that you changed this repo from open source to "viewable but proprietary" and it expressively forbids non-commercial use, which i interpret as private use. It also expressively forbids copying the source code.

And when I told support I made a local build to try to retrieve my personal crypto from the Optimism Superchains, they informed me that i was in violation of the "current license" and they could not help me

Which of course runs contradictory to your "open source" marketing.

I'm very concerned and confused on several items:

1. X is swearing up and down that "We can build this locally and there are full instructions" - there are not, the README is incomplete because it does not explain how to build an app that has the ability to scan valid cards in a personal compacity.

2. The license was changed in July from open source to full proprietary, yet as recently as September, months after the license change, all marketing material uses the phrase "Open Source"

The way i reading this new license change is that, we are only allowed to use the software to retrieve our crypto with Tangems permission, which means we don't actually own our keys, Tangem does. Because in practicality, we have to use Tangems SDK to access our own funds, which are now behind one of the most restrictive licenses I've ever seen that call out "Non-Commercial copying of the software (aka git clone)" as prohibited use. Yet the CTO of Tangem on X is telling us to ignore the license because we are fully free to build.

This is just a really really bad look for the company, and I think these decisions need to be reviewed. Its very trust breaking.

[CyphrRiot]

There's no fckn way this lasts long-term. Tangem not allowing access to your wallet or funds would cause an absolute fckn meltdown and a complete lack of trust.

If Tangem doesn't support extraction of funds from their devices if their Tangem wallet goes away -- which is the whole point -- the company will fall apart very quickly. This has to be miscommunication.

[kozarezvlad]

We’ve specifically prepared the app — and its source code — so that anyone can build it easily. Today, building the app is a fairly complex process due to multiple security layers that protect our users, but we’ve done the extra work to make the build process as straightforward as possible.

We identified a backend-side issue: when an invalid API key was passed in the card attestation request, the backend returned 403 instead of 401, which prevented the attestation process from completing correctly.
This behavior has now been fixed, and any application built from the public branch will function as expected.

A few additional steps are required on your side:

Replace [REDACTED_ENV_URL] with the production URLs in your configuration.

After launching the application, open the tester menu by pressing the volume-down button three times, then switch the environment toggles to prod.

Make sure that your blockchain nodes are functional. To do this, add the corresponding node keys to config_dev.json. You can generate these keys yourself.

If you have any questions or encounter issues after making these changes, feel free to reach out.

Additionally, there are no restrictions on using this code for personal, non-commercial purposes.

Also, in the case described, if the backend had not responded with a 403, but had been completely down and returned a 500, then you would have been able to use the card.

[trgarrett]

We identified a backend-side issue: when an invalid API key was passed in the card attestation request, the backend returned 403 instead of 401, which prevented the attestation process from completing correctly.
This behavior has now been fixed, and any application built from the public branch will function as expected.

@kozarezvlad Is there a configuration option to bypass the Online attestation service? Aside from what @MichaelTaylor3d is trying to accomplish, the biggest use case for building the code yourself is to protect a user's assets in the event Tangem AG were to cease operations. Being dependent on a web service for this flow runs directly counter to that objective.

Also, in the case described, if the backend had not responded with a 403, but had been completely down and returned a 500, then you would have been able to use the card.

What if the endpoint ceased to exist at all and no status was returned?

[trgarrett]

Thank you for the update. It does successfully allow the card to be activated with this version. The volume down events are handled by the OS on my device (Android 16), so I can't vet the ability to switch API. This results in a bunch of Unreachable networks.

So, I'd say it's accurate to think that you can only use the tangem-sdk-android in the end-of-operations scenario. That's good to know.

[MichaelTaylor3d]

I'll be able to test today or tomorrow but it looks like @trgarrett already confirmed it's working for him. Id like to kindly request these steps added to the readme, as well as any other supplemental information. Thank you.

[trgarrett]

I'll be able to test today or tomorrow but it looks like @trgarrett already confirmed it's working for him

Unfortunately, I only got one step farther. Whether it's unique to my Android or what, I could still not get the app functional. Sorry for hijacking your thread. I just got sucked in by the mystery of it all!

[kozarezvlad]

What if the endpoint ceased to exist at all and no status was returned?

Than it will be work as expected and attestation will be skipped. Problem was only if endpoint response 403/404 error in this case we assume that card is counterfeit.

We've just made some changes to the build, and you won't need to do anything else to run the application. However, not all blockchains will be accessible, and to use them, you'll need to add your own API keys from the getblock/nownodes/infura providers. Without this step, only blockchains with public nodes will work.

[MichaelTaylor3d]

Hi @kozarezvlad,

I've successfully added support for Ink, Kraken's dedicated DeFi chain built on Optimism's Superchain, and verified that funds can be transferred from seedless cards.

This integration should be valuable to your community—Ink is one of the participating platforms on Velodrome, and without this change, rewards remain inaccessible on Tangem wallets.

I also plan to submit additional PRs for the remaining Superchain networks supported by Velodrome: Lisk, Celo, Soneium, Unichain, Swell, Mode, and Fraxtal. Together, these additions would make Tangem fully compatible with the Velodrome ecosystem.

Please consider the following PRS:
#7
tangem/blockchain-sdk-kotlin#3

[trgarrett]

We've just made some changes to the build, and you won't need to do anything else to run the application. However, not all blockchains will be accessible, and to use them, you'll need to add your own API keys from the getblock/nownodes/infura providers. Without this step, only blockchains with public nodes will work.

That is fabulous news. Thank you! I will dig in and review how that works with Chia as that is my native chain. Thank you for your hard work and commitment to customers!

[MarvinQuevedo]

@kozarezvlad Hi @kozarezvlad, I understand this is a different topic, but it’s related. I’m having trouble using the SDK on Android and iOS. Can you help me with this? Could you explain how I can use the SDK again? I’m using it on Flutter and was updating the SDK to keep it working, but I can’t use it again with the latest changes.

tangem/tangem-sdk-android#3